From 604983800f2b0f072160f4afa65823872bceae07 Mon Sep 17 00:00:00 2001 From: Cilly Leang Date: Sat, 30 May 2026 01:27:12 +1000 Subject: [PATCH 01/57] hyacinth/packages: add discord --- hosts/hyacinth/packages.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/hosts/hyacinth/packages.nix b/hosts/hyacinth/packages.nix index f4e4fe4..69f9ba1 100644 --- a/hosts/hyacinth/packages.nix +++ b/hosts/hyacinth/packages.nix @@ -1,5 +1,6 @@ { pkgs, ... }: { environment.systemPackages = with pkgs; [ + discord jetbrains.idea texliveFull ]; From 4a82035d825230d6ef4f304a61c90f235dd528af Mon Sep 17 00:00:00 2001 From: Cilly Leang Date: Sat, 30 May 2026 01:45:45 +1000 Subject: [PATCH 02/57] hosts/hyacinth: enable tailscale --- hosts/hyacinth/default.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/hosts/hyacinth/default.nix b/hosts/hyacinth/default.nix index 620798b..c307ce8 100644 --- a/hosts/hyacinth/default.nix +++ b/hosts/hyacinth/default.nix @@ -28,6 +28,7 @@ printing security snapper + tailscale wireguard modules.services.syncthing From 1941deb004910565e1f08ad7736dfa49a22dc452 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Fri, 29 May 2026 04:02:18 +0000 Subject: [PATCH 03/57] flake: bump inputs --- flake.lock | 102 ++++++++++++++++++++++++++--------------------------- 1 file changed, 51 insertions(+), 51 deletions(-) diff --git a/flake.lock b/flake.lock index d6070b9..db4bae9 100644 --- a/flake.lock +++ b/flake.lock @@ -7,11 +7,11 @@ "rust-overlay": "rust-overlay" }, "locked": { - "lastModified": 1777475243, - "narHash": "sha256-EiCeDGJewyWq2Mtdt5m8qyo/W5PXVUCacLuZJ/diBQ8=", + "lastModified": 1779903856, + "narHash": "sha256-uRShMtD6xW3ZKZbCQ6sDzKWEnbBXUg3IGfOARYogKhg=", "owner": "ezKEa", "repo": "aagl-gtk-on-nix", - "rev": "12e7b06163456e4c3685ee83b8fdc277fe03bdc8", + "rev": "50671fc7f29d686f63ef34b603320d44ad7f2d29", "type": "github" }, "original": { @@ -295,11 +295,11 @@ ] }, "locked": { - "lastModified": 1777988971, - "narHash": "sha256-qIoWPDs+0/8JecyYgE3gpKQxW/4bLW/gp45vow9ioCQ=", + "lastModified": 1778716662, + "narHash": "sha256-m1Yf0wZ8j1OHjTc2UwHwyQRSnNeSgLJOd7q5Y45hzi4=", "owner": "hercules-ci", "repo": "flake-parts", - "rev": "0678d8986be1661af6bb555f3489f2fdfc31f6ff", + "rev": "f7c1a2d347e4c52d5fb8d10cb4d94b5884e546fb", "type": "github" }, "original": { @@ -313,11 +313,11 @@ "nixpkgs-lib": "nixpkgs-lib" }, "locked": { - "lastModified": 1777988971, - "narHash": "sha256-qIoWPDs+0/8JecyYgE3gpKQxW/4bLW/gp45vow9ioCQ=", + "lastModified": 1778716662, + "narHash": "sha256-m1Yf0wZ8j1OHjTc2UwHwyQRSnNeSgLJOd7q5Y45hzi4=", "owner": "hercules-ci", "repo": "flake-parts", - "rev": "0678d8986be1661af6bb555f3489f2fdfc31f6ff", + "rev": "f7c1a2d347e4c52d5fb8d10cb4d94b5884e546fb", "type": "github" }, "original": { @@ -390,11 +390,11 @@ ] }, "locked": { - "lastModified": 1776796298, - "narHash": "sha256-PcRvlWayisPSjd0UcRQbhG8Oqw78AcPE6x872cPRHN8=", + "lastModified": 1778507602, + "narHash": "sha256-kTwur1wV+01SdqskVMSo6JMEpg71ps3HpbFY2GsflKs=", "owner": "cachix", "repo": "git-hooks.nix", - "rev": "3cfd774b0a530725a077e17354fbdb87ea1c4aad", + "rev": "61ab0e80d9c7ab14c256b5b453d8b3fb0189ba0a", "type": "github" }, "original": { @@ -496,11 +496,11 @@ ] }, "locked": { - "lastModified": 1778365864, - "narHash": "sha256-ImoT/wqmgMImf2dAC+E0MverAdA4QXsedOeES9B7Ezw=", + "lastModified": 1779969295, + "narHash": "sha256-HwIJ3tOcwSMiV75L7KqJXciXR9UfT+d7rwOZMX7cTnA=", "owner": "nix-community", "repo": "home-manager", - "rev": "2f419037039a152448c5f4ae9494154753d1b399", + "rev": "61e2c9659324181e0f0ed911958c536333b1d4f6", "type": "github" }, "original": { @@ -540,11 +540,11 @@ "linux-tkg": { "flake": false, "locked": { - "lastModified": 1778301982, - "narHash": "sha256-M8a1VqhhI3Ii0KFY4n1UdzUIFwZbET+G464cCb5ye5U=", + "lastModified": 1779857514, + "narHash": "sha256-dCrVB3cFvv1d/9wuEejYN131b1phyf6SDy1bcEvtWGo=", "owner": "Frogging-Family", "repo": "linux-tkg", - "rev": "d20b99557a90663a016f741398098d4d7b3ad119", + "rev": "c9196dea7ee464f7792f94cd39c32431ad9e25ab", "type": "github" }, "original": { @@ -562,11 +562,11 @@ ] }, "locked": { - "lastModified": 1778371477, - "narHash": "sha256-sVlZeFIds47ABfBbAmBLexCFnkE1GIBTNGjAMRh+BfA=", + "lastModified": 1780013080, + "narHash": "sha256-m984DKbcIeNNuLYFjN3780rPEd55Xe9/cB4BNKkIDvg=", "owner": "nix-community", "repo": "neovim-nightly-overlay", - "rev": "b9ee678fadf59b3c998e180d62f4cee0641d21d9", + "rev": "c6cc238427db8f61b786a66d7e02cf7724b30226", "type": "github" }, "original": { @@ -578,11 +578,11 @@ "neovim-src": { "flake": false, "locked": { - "lastModified": 1778321961, - "narHash": "sha256-lrPZ0C+uixk+6jx+maWM998GZaj4lAuicAz/dZHFNBk=", + "lastModified": 1779979065, + "narHash": "sha256-3uF/oP2D4Jka3DU2G8qqml75UOzPRrK+FIp+jghOq0s=", "owner": "neovim", "repo": "neovim", - "rev": "b44c2bdd16226f6caa5324d91f1ae9781ffdc12b", + "rev": "5d85669a33e10f1f156b086562458cbbc8054438", "type": "github" }, "original": { @@ -598,11 +598,11 @@ "nixpkgs": "nixpkgs_9" }, "locked": { - "lastModified": 1778384395, - "narHash": "sha256-ymn6ivl8RbUK8oevC+aRQ3IY3cB3Jg0dCv7LR5XSBVo=", + "lastModified": 1779768228, + "narHash": "sha256-/dRavNAx/Mp67xcQQ3JBIMyf0cLoXqKedafB1+wksAE=", "owner": "fufexan", "repo": "nix-gaming", - "rev": "8368f981774ee25774d016e810d426891174a993", + "rev": "6e7a8414c0f547a86646eb0b56ebf89e7cc217a2", "type": "github" }, "original": { @@ -618,11 +618,11 @@ ] }, "locked": { - "lastModified": 1778240325, - "narHash": "sha256-d2HIS7LpfI0lgxiXCXLjxrHl3eIdNvAVexOu0xiM488=", + "lastModified": 1779604987, + "narHash": "sha256-ZQ5z+fVhxYKtIFwtqGp5O0PD84BM1riASvqDaN5Xs+s=", "owner": "nix-community", "repo": "nix-index-database", - "rev": "dd2d0e3f6ba00af01b9498f5697173bdc2524bee", + "rev": "8fba98c80b48fa013820e0163c5096922fea4ddd", "type": "github" }, "original": { @@ -633,11 +633,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1770841267, - "narHash": "sha256-9xejG0KoqsoKEGp2kVbXRlEYtFFcDTHjidiuX8hGO44=", + "lastModified": 1777268161, + "narHash": "sha256-bxrdOn8SCOv8tN4JbTF/TXq7kjo9ag4M+C8yzzIRYbE=", "owner": "nixos", "repo": "nixpkgs", - "rev": "ec7c70d12ce2fc37cb92aff673dcdca89d187bae", + "rev": "1c3fe55ad329cbcb28471bb30f05c9827f724c76", "type": "github" }, "original": { @@ -680,11 +680,11 @@ }, "nixpkgs_10": { "locked": { - "lastModified": 1777954456, - "narHash": "sha256-hGdgeU2Nk87RAuZyYjyDjFL6LK7dAZN5RE9+hrDTkDU=", + "lastModified": 1779560665, + "narHash": "sha256-tpyBcxPpcQb8ukyNF7DoCwfSY3VPsxHoYwj00Cayv5o=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "549bd84d6279f9852cae6225e372cc67fb91a4c1", + "rev": "64c08a7ca051951c8eae34e3e3cb1e202fe36786", "type": "github" }, "original": { @@ -824,11 +824,11 @@ }, "nixpkgs_9": { "locked": { - "lastModified": 1778274207, - "narHash": "sha256-I4puXmX1iovcCHZlRmztO3vW0mAbbRvq4F8wgIMQ1MM=", + "lastModified": 1779536132, + "narHash": "sha256-q+fF42iv/geEbHfgSzy3tS0FF/EyD6XTZ98E6yxiBO8=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "b3da656039dc7a6240f27b2ef8cc6a3ef3bccae7", + "rev": "3d8f0f3f72a6cd4d93d0ad13203f2ea1cb7e1456", "type": "github" }, "original": { @@ -923,11 +923,11 @@ "pure": { "flake": false, "locked": { - "lastModified": 1770811375, - "narHash": "sha256-Fhk4nlVPS09oh0coLsBnjrKncQGE6cUEynzDO2Skiq8=", + "lastModified": 1779255807, + "narHash": "sha256-UQ0hP3qJd4Qxiw1LXPdb9d0Dc4OSD3HJpgYzaCfujno=", "owner": "sindresorhus", "repo": "pure", - "rev": "dbefd0dcafaa3ac7d7222ca50890d9d0c97f7ca2", + "rev": "cc0759a0de620f191510e2e2f9748194a605b54d", "type": "github" }, "original": { @@ -976,11 +976,11 @@ ] }, "locked": { - "lastModified": 1770952264, - "narHash": "sha256-CjymNrJZWBtpavyuTkfPVPaZkwzIzGaf0E/3WgcwM14=", + "lastModified": 1777605393, + "narHash": "sha256-Hjp0VOOHgHcTrX23iVvnfAudPcuCmfkfpQNFwv2v/ks=", "owner": "oxalica", "repo": "rust-overlay", - "rev": "ec6a3d5cdf14bb5a1dd03652bd3f6351004d2188", + "rev": "ff88db34cfa486fc4964a6991cab1678d82eee8c", "type": "github" }, "original": { @@ -997,11 +997,11 @@ "systems": "systems_5" }, "locked": { - "lastModified": 1777789800, - "narHash": "sha256-XHCvLGu/bEEZRzXVKFu1i+2YB102Nr00n8e7xrzsfVs=", + "lastModified": 1779824049, + "narHash": "sha256-dWHVUjP03KSVG1PaLKA6j9EdxWSxSQvipMUIcSyuA/U=", "owner": "Gerg-L", "repo": "spicetify-nix", - "rev": "d0e921cc48aab6137d203a3eab19601dc2bdc0c3", + "rev": "1362178e5f5f7a848c49fe9dee004ef8824f100a", "type": "github" }, "original": { @@ -1029,11 +1029,11 @@ "stevenblack-hosts": { "flake": false, "locked": { - "lastModified": 1778258800, - "narHash": "sha256-wTiDXFiBKV4M4jv1JrVLL/kkIyE1FK4qino07BYU5fc=", + "lastModified": 1779976382, + "narHash": "sha256-wt5NGa4K8/vda669UYUmTUt+BR9X5fPnuTZFfQdpLYo=", "owner": "StevenBlack", "repo": "hosts", - "rev": "8ce06e1ed6f063d3d58cf9c980793415085f5d89", + "rev": "d3e838712512490260f051150e3573eeebecfadb", "type": "github" }, "original": { From 1d9f9f4927fcedfdc810ce98a3f2666f0d7b8ae4 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Fri, 29 May 2026 04:02:19 +0000 Subject: [PATCH 04/57] packages/linux-lava: bump to 7.0.10 --- packages/linux-lava/sources.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/packages/linux-lava/sources.nix b/packages/linux-lava/sources.nix index c24fa57..1ea7dcb 100644 --- a/packages/linux-lava/sources.nix +++ b/packages/linux-lava/sources.nix @@ -1,8 +1,8 @@ { fetchFromGitHub, inputs, lib }: let - version = "7.0.5"; + version = "7.0.10"; kernelHash = "1w4i705i0nl1xqv7fdhdbhy7j3xrzhl31fabs6vmgiw7nf06szxv"; - kernelPatchHash = "15a173sx7nw4qkp45f5ksnqd3a1flhpiq3zzsa6gzzcww433hm8d"; + kernelPatchHash = "0h7gxqcnww7sj5cdyblzj04775zhavwdylkm2pm91v6xkjbnz1zj"; mm = lib.versions.majorMinor version; hasPatch = (builtins.length (builtins.splitVersion version)) == 3; From 10fbeac1404f2719437b1d229e128d078ac54694 Mon Sep 17 00:00:00 2001 From: Cilly Leang Date: Sat, 30 May 2026 01:57:08 +1000 Subject: [PATCH 05/57] user/eww: manually set configDir why was this changed??? --- modules/user/eww.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/user/eww.nix b/modules/user/eww.nix index 9d839e0..fa5fd4e 100644 --- a/modules/user/eww.nix +++ b/modules/user/eww.nix @@ -24,6 +24,6 @@ in { home.packages = with pkgs; [ socat ]; programs.eww = { enable = true; - configDir = res; }; + xdg.configFile."eww".source = res; } From 0edeac9f4c06b2dcf20a2338d81dc8ec55643946 Mon Sep 17 00:00:00 2001 From: Cilly Leang Date: Sat, 30 May 2026 19:38:31 +1000 Subject: [PATCH 06/57] user/neovim: remove lsp.with --- res/config.lua | 39 +++++++++++++++++---------------------- 1 file changed, 17 insertions(+), 22 deletions(-) diff --git a/res/config.lua b/res/config.lua index 5d205d7..3e91e28 100644 --- a/res/config.lua +++ b/res/config.lua @@ -108,18 +108,18 @@ require('lualine').setup { -- many thanks to @kristijanhusak -- https://github.com/nvim-treesitter/nvim-treesitter/issues/1167#issuecomment-920824125 function _G.javascript_indent() - local line = vim.fn.getline(vim.v.lnum) - local prev_line = vim.fn.getline(vim.v.lnum - 1) - if line:match('^%s*[%*/]%s*') then - if prev_line:match('^%s*%*%s*') then - return vim.fn.indent(vim.v.lnum - 1) + local line = vim.fn.getline(vim.v.lnum) + local prev_line = vim.fn.getline(vim.v.lnum - 1) + if line:match('^%s*[%*/]%s*') then + if prev_line:match('^%s*%*%s*') then + return vim.fn.indent(vim.v.lnum - 1) + end + if prev_line:match('^%s*/%*%*%s*$') then + return vim.fn.indent(vim.v.lnum - 1) + 1 + end end - if prev_line:match('^%s*/%*%*%s*$') then - return vim.fn.indent(vim.v.lnum - 1) + 1 - end - end - return vim.fn['GetJavascriptIndent']() + return vim.fn['GetJavascriptIndent']() end vim.cmd('au FileType javascript setlocal indentexpr=v:lua.javascript_indent()') @@ -157,18 +157,13 @@ vim.api.nvim_create_autocmd("LspAttach", { end }) -vim.lsp.handlers["textDocument/publishDiagnostics"] = vim.lsp.with( - vim.lsp.diagnostic.on_publish_diagnostics, { - focusable = false, - virtual_text = false, - underline = true, - signs = true, - update_in_insert = true - } -) -vim.lsp.handlers["textDocument/signatureHelp"] = vim.lsp.with( - vim.lsp.handlers.signature_help, { focusable = false } -) +vim.diagnostic.config({ + focusable = false, + virtual_text = false, + underline = true, + signs = true, + update_in_insert = true +}) capabilities = require('cmp_nvim_lsp').default_capabilities(capabilities) From 939d0cc861132ef4f1c6577fcfe4c0ebbf3c7c52 Mon Sep 17 00:00:00 2001 From: Cilly Leang Date: Sat, 30 May 2026 20:37:42 +1000 Subject: [PATCH 07/57] system/tailscale: persist tailscale state --- modules/binds.nix | 9 +++++++++ modules/default.nix | 1 + modules/options.nix | 5 +++++ modules/system/base.nix | 2 +- modules/system/tailscale.nix | 1 + 5 files changed, 17 insertions(+), 1 deletion(-) create mode 100644 modules/binds.nix diff --git a/modules/binds.nix b/modules/binds.nix new file mode 100644 index 0000000..9c7d4ad --- /dev/null +++ b/modules/binds.nix @@ -0,0 +1,9 @@ +{ config, lib, ...}: { + imports = [ ./options.nix ]; + fileSystems = lib.mapAttrs (dest: key: { + depends = [ "/persist" ]; + device = "/persist/binds/${key}"; + fsType = "none"; + options = [ "bind" ]; + }) config.me.binds; +} diff --git a/modules/default.nix b/modules/default.nix index d55b54a..6775c55 100644 --- a/modules/default.nix +++ b/modules/default.nix @@ -14,6 +14,7 @@ let }) paths ); in { + binds = ./binds.nix; options = ./options.nix; services = mkAttrsFromPaths [ ./services/banksia.nix diff --git a/modules/options.nix b/modules/options.nix index b522127..e861c12 100644 --- a/modules/options.nix +++ b/modules/options.nix @@ -44,5 +44,10 @@ in { type = types.bool; default = false; }; + + binds = lib.mkOption { + type = with lib.types; attrsOf str; + default = {}; + }; }; } diff --git a/modules/system/base.nix b/modules/system/base.nix index 36c9993..c45eb99 100644 --- a/modules/system/base.nix +++ b/modules/system/base.nix @@ -1,5 +1,5 @@ { config, inputs, modules, ... }: { - imports = [ modules.options ]; + imports = [ modules.binds modules.options ]; environment.etc = { "machine-id".source = "/persist/machine-id"; diff --git a/modules/system/tailscale.nix b/modules/system/tailscale.nix index 4bded31..732a9bb 100644 --- a/modules/system/tailscale.nix +++ b/modules/system/tailscale.nix @@ -1,5 +1,6 @@ { config, ... }: { age.secrets.tailscale_auth.file = ../../secrets/tailscale_auth.age; + me.binds."/var/lib/tailscale" = "tailscale"; services.tailscale = { enable = true; authKeyFile = config.age.secrets.tailscale_auth.path; From babc27c8be3385495c04d8841ec8f94346fa5cc9 Mon Sep 17 00:00:00 2001 From: Cilly Leang Date: Thu, 28 May 2026 23:01:43 +1000 Subject: [PATCH 08/57] containers/garnet: init --- containers/garnet/configuration.nix | 32 ++++++++++++ containers/garnet/flake.lock | 27 ++++++++++ containers/garnet/flake.nix | 80 +++++++++++++++++++++++++++++ flake.lock | 47 ++++++++++++++--- flake.nix | 1 + 5 files changed, 179 insertions(+), 8 deletions(-) create mode 100644 containers/garnet/configuration.nix create mode 100644 containers/garnet/flake.lock create mode 100644 containers/garnet/flake.nix diff --git a/containers/garnet/configuration.nix b/containers/garnet/configuration.nix new file mode 100644 index 0000000..930ae67 --- /dev/null +++ b/containers/garnet/configuration.nix @@ -0,0 +1,32 @@ +{ ... }: { + system.stateVersion = "25.11"; + fileSystems."/var/lib/opencloud" = { + device = "/persist/opencloud"; + fsType = "none"; + options = [ "bind" ]; + }; + networking.firewall.allowedTCPPorts = [ 9200 ]; + networking.firewall.allowedUDPPorts = [ 9200 ]; + + services.slskd = { + enable = true; + domain = null; + environmentFile = "/binds/slskd_env"; + settings = { + shares.directories = [ "/binds/music/" ]; + }; + }; + environment.etc."opencloud-admin-pass".text = '' + IDM_ADMIN_PASSWORD=supersillysecure + ''; + services.opencloud = { + enable = true; + url = "https://cloud.lava.moe"; + address = "127.0.0.1"; + port = 9200; + environment = { + PROXY_TLS = "false"; + }; + environmentFile = "/etc/opencloud-admin-pass"; + }; +} diff --git a/containers/garnet/flake.lock b/containers/garnet/flake.lock new file mode 100644 index 0000000..4070242 --- /dev/null +++ b/containers/garnet/flake.lock @@ -0,0 +1,27 @@ +{ + "nodes": { + "nixpkgs": { + "locked": { + "lastModified": 1779560665, + "narHash": "sha256-tpyBcxPpcQb8ukyNF7DoCwfSY3VPsxHoYwj00Cayv5o=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "64c08a7ca051951c8eae34e3e3cb1e202fe36786", + "type": "github" + }, + "original": { + "owner": "NixOS", + "ref": "nixos-unstable", + "repo": "nixpkgs", + "type": "github" + } + }, + "root": { + "inputs": { + "nixpkgs": "nixpkgs" + } + } + }, + "root": "root", + "version": 7 +} diff --git a/containers/garnet/flake.nix b/containers/garnet/flake.nix new file mode 100644 index 0000000..7cb7559 --- /dev/null +++ b/containers/garnet/flake.nix @@ -0,0 +1,80 @@ +{ + inputs = { + nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable"; + }; + outputs = { nixpkgs, ... }: + let + name = "garnet"; + fqdn = "cloud.lava.moe"; + subnetId = "7"; + + subnet = x: "fd0d:1::${subnetId}:${toString x}"; + host = subnet 1; + client = subnet 2; + + subnet4 = x: "10.30.${subnetId}.${toString x}"; + host4 = subnet4 1; + client4 = subnet4 2; + + modules = [ + ./configuration.nix + { + networking.useHostResolvConf = false; + networking.nameservers = [ host ]; + } + ]; + in { + nixosConfigurations.container = nixpkgs.lib.nixosSystem { + inherit modules; + }; + nixosModule = { config, ... }: { + networking.nat = { + enable = true; + enableIPv6 = true; + internalInterfaces = [ "ve-${name}" ]; + }; + + services.nginx.virtualHosts."${fqdn}" = { + useACMEHost = "lava.moe"; + forceSSL = true; + locations."/" = { + proxyPass = "http://[${client}]:9200"; + proxyWebsockets = true; + extraConfig = '' + proxy_set_header Host $host; + ''; + }; + listenAddresses = [ "10.0.0.1" "[fd0d::1]" "100.67.1.1" ]; + }; + + systemd.tmpfiles.rules = [ + "d /persist/containers/${name} 755 root users" + "d /persist/flower 755 root users" + ]; + containers.${name} = { + autoStart = true; + privateNetwork = true; + hostAddress = host4; + localAddress = client4; + hostAddress6 = host; + localAddress6 = client; + # privateUsers = "pick"; + nixpkgs = nixpkgs; + ephemeral = true; + config = { imports = modules; }; + specialArgs = { inherit fqdn; }; + + bindMounts."persist" = { + hostPath = "/persist/containers/${name}"; + mountPoint = "/persist"; + isReadOnly = false; + }; + bindMounts."content" = { + hostPath = "/persist/flower"; + mountPoint = "/flower"; + isReadOnly = false; + }; + }; + }; + }; +} diff --git a/flake.lock b/flake.lock index db4bae9..2578a7e 100644 --- a/flake.lock +++ b/flake.lock @@ -128,6 +128,20 @@ }, "parent": [] }, + "c-garnet": { + "inputs": { + "nixpkgs": "nixpkgs_9" + }, + "locked": { + "path": "./containers/garnet", + "type": "path" + }, + "original": { + "path": "./containers/garnet", + "type": "path" + }, + "parent": [] + }, "catppuccin": { "inputs": { "nixpkgs": "nixpkgs_4" @@ -595,7 +609,7 @@ "inputs": { "flake-parts": "flake-parts_2", "git-hooks": "git-hooks", - "nixpkgs": "nixpkgs_9" + "nixpkgs": "nixpkgs_10" }, "locked": { "lastModified": 1779768228, @@ -679,6 +693,22 @@ } }, "nixpkgs_10": { + "locked": { + "lastModified": 1779536132, + "narHash": "sha256-q+fF42iv/geEbHfgSzy3tS0FF/EyD6XTZ98E6yxiBO8=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "3d8f0f3f72a6cd4d93d0ad13203f2ea1cb7e1456", + "type": "github" + }, + "original": { + "owner": "NixOS", + "ref": "nixpkgs-unstable", + "repo": "nixpkgs", + "type": "github" + } + }, + "nixpkgs_11": { "locked": { "lastModified": 1779560665, "narHash": "sha256-tpyBcxPpcQb8ukyNF7DoCwfSY3VPsxHoYwj00Cayv5o=", @@ -694,7 +724,7 @@ "type": "github" } }, - "nixpkgs_11": { + "nixpkgs_12": { "locked": { "lastModified": 1770019141, "narHash": "sha256-VKS4ZLNx4PNrABoB0L8KUpc1fE7CLpQXQs985tGfaCU=", @@ -824,16 +854,16 @@ }, "nixpkgs_9": { "locked": { - "lastModified": 1779536132, - "narHash": "sha256-q+fF42iv/geEbHfgSzy3tS0FF/EyD6XTZ98E6yxiBO8=", + "lastModified": 1779560665, + "narHash": "sha256-tpyBcxPpcQb8ukyNF7DoCwfSY3VPsxHoYwj00Cayv5o=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "3d8f0f3f72a6cd4d93d0ad13203f2ea1cb7e1456", + "rev": "64c08a7ca051951c8eae34e3e3cb1e202fe36786", "type": "github" }, "original": { "owner": "NixOS", - "ref": "nixpkgs-unstable", + "ref": "nixos-unstable", "repo": "nixpkgs", "type": "github" } @@ -880,7 +910,7 @@ "pastel": { "inputs": { "flake-utils": "flake-utils_2", - "nixpkgs": "nixpkgs_11", + "nixpkgs": "nixpkgs_12", "pnpm2nix": "pnpm2nix" }, "locked": { @@ -946,6 +976,7 @@ "c-diamond": "c-diamond", "c-emerald": "c-emerald", "c-fluorite": "c-fluorite", + "c-garnet": "c-garnet", "catppuccin": "catppuccin_2", "catppuccin-palette": "catppuccin-palette", "fast-syntax-highlighting": "fast-syntax-highlighting", @@ -954,7 +985,7 @@ "neovim-nightly": "neovim-nightly", "nix-gaming": "nix-gaming", "nix-index-database": "nix-index-database", - "nixpkgs": "nixpkgs_10", + "nixpkgs": "nixpkgs_11", "nvim-treesitter": "nvim-treesitter", "pastel": "pastel", "pure": "pure", diff --git a/flake.nix b/flake.nix index 377e601..5cf3457 100644 --- a/flake.nix +++ b/flake.nix @@ -44,6 +44,7 @@ c-diamond.url = "path:./containers/diamond"; c-emerald.url = "path:./containers/emerald"; c-fluorite.url = "path:./containers/fluorite"; + c-garnet.url = "path:./containers/garnet"; }; outputs = { self, agenix, catppuccin, nixpkgs, ... } @ inputs: From 140b12fa5d95ee0a77c6233ba537dc9fab64c0b7 Mon Sep 17 00:00:00 2001 From: Cilly Leang Date: Thu, 28 May 2026 23:02:40 +1000 Subject: [PATCH 09/57] hosts/alyssum: enable garnet --- hosts/alyssum/default.nix | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/hosts/alyssum/default.nix b/hosts/alyssum/default.nix index 087c77f..1c1db61 100644 --- a/hosts/alyssum/default.nix +++ b/hosts/alyssum/default.nix @@ -1,4 +1,4 @@ -{ lib, modules, modulesPath, ... }: { +{ inputs, modules, modulesPath, ... }: { networking.hostName = "alyssum"; system.stateVersion = "25.11"; time.timeZone = "Australia/Melbourne"; @@ -22,6 +22,8 @@ security tailscale + inputs.c-garnet.nixosModule + ./filesystem.nix ./kernel.nix ./networking.nix From 27e9546327e2d9f2a756f3f65b657ea61e34bfca Mon Sep 17 00:00:00 2001 From: Cilly Leang Date: Thu, 28 May 2026 23:04:35 +1000 Subject: [PATCH 10/57] containers/garnet: better ip filtering --- containers/garnet/flake.nix | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/containers/garnet/flake.nix b/containers/garnet/flake.nix index 7cb7559..b5e4ba5 100644 --- a/containers/garnet/flake.nix +++ b/containers/garnet/flake.nix @@ -44,7 +44,13 @@ proxy_set_header Host $host; ''; }; - listenAddresses = [ "10.0.0.1" "[fd0d::1]" "100.67.1.1" ]; + extraConfig = '' + allow 10.0.0.0/8; + allow 100.0.0.0/8; + allow 192.168.1.0/24; + allow fd0d::/8; + deny all; + ''; }; systemd.tmpfiles.rules = [ From a25d214b82c4459e1e71599bf8917cc12090b337 Mon Sep 17 00:00:00 2001 From: Cilly Leang Date: Thu, 28 May 2026 23:10:40 +1000 Subject: [PATCH 11/57] hosts/alyssum: enable nginx --- hosts/alyssum/default.nix | 3 +++ secrets.nix | 2 +- secrets/acme_dns.age | 19 ++++++++++--------- 3 files changed, 14 insertions(+), 10 deletions(-) diff --git a/hosts/alyssum/default.nix b/hosts/alyssum/default.nix index 1c1db61..9a53926 100644 --- a/hosts/alyssum/default.nix +++ b/hosts/alyssum/default.nix @@ -4,6 +4,7 @@ time.timeZone = "Australia/Melbourne"; age.secrets = { + acme_dns.file = ../../secrets/acme_dns.age; wpa_conf = { file = ../../secrets/wpa_conf.age; path = "/etc/wpa_supplicant/imperative.conf"; @@ -22,6 +23,8 @@ security tailscale + modules.services.nginx + inputs.c-garnet.nixosModule ./filesystem.nix diff --git a/secrets.nix b/secrets.nix index 5a8bf1b..d2dbc82 100644 --- a/secrets.nix +++ b/secrets.nix @@ -10,7 +10,7 @@ in { "secrets/passwd.age".publicKeys = [ anemone blossom rin ]; "secrets/wpa_conf.age".publicKeys = [ alyssum blossom rin ]; - "secrets/acme_dns.age".publicKeys = [ dandelion hazel rin ]; + "secrets/acme_dns.age".publicKeys = [ alyssum dandelion hazel rin ]; "secrets/navidrome_env.age".publicKeys = [ anemone dandelion rin ]; "secrets/slskd_env.age".publicKeys = [ anemone dandelion rin ]; "secrets/tailscale_auth.age".publicKeys = [ alyssum anemone blossom dandelion rin ]; diff --git a/secrets/acme_dns.age b/secrets/acme_dns.age index a573417..c440de6 100644 --- a/secrets/acme_dns.age +++ b/secrets/acme_dns.age @@ -1,10 +1,11 @@ age-encryption.org/v1 --> ssh-ed25519 bRFqeQ trK7wfJ1fObF70yD3a6axuXaZv/EzzFI7he1dvUajH8 -1C5IrwITtma/um0zUo6by0llVTnla7TBdyRD07azTT8 --> ssh-ed25519 ZAcXHw f+n0WJKTViwizwTIgRpbLGqk458SnuAFVVj5FQS0nwA -MRinOTxWGwfeg16VWJYD+1Uta+7xF6G9oyqtYSfEq80 --> ssh-ed25519 U9FXlg 24QGfemIAHZYMwroayNJp91fUkbwUF7ACuXIk+7qdBg -RNGpjxUgfzV/e1Ab/NcA8A0zzxsXU06xmVbLpG3x+iI ---- mekieJNQOl4vcg+hsSOQsFC7mVUZf/oRl/dT7AeTRKg -H즏)k#%3cQں1?ad| 쳄ٗo2 -B)=Zi9pR Klg ՞h \ No newline at end of file +-> ssh-ed25519 kOMSPw vqjZO82kILUQaoD9EwOgnmXKD9IyscgtzP65BVKkGhs +07f0vL5fSq+EVdJ4n3L/q0tGsh0SVLCueTzbrMQC2ok +-> ssh-ed25519 bRFqeQ qZAsyhdIY/fg7weEBYfB/WwFBrr/fDRrjt0J/m+57W4 +FOWjbk7efoVdL9WxjWvaZ/0mJrQ4yj0fN/Fa3zztz84 +-> ssh-ed25519 ZAcXHw UHpAQ4nKoGGaZWXVj4UM6uBanOgDpBvG6XdoBvhz6y8 +xF1orqajQxp2QzU/e1sq8lMxz4AQ2Vr5a3wEU55QqyE +-> ssh-ed25519 U9FXlg n/LPuRDZ7N0VbZYLNr86hH/yRuqd2zFC7Nnpooz8d0o +aZig/wjd5vitGaJwQ89w2M7fj8fAiqTpdDOmLae74sM +--- mXuALIh6k4n0cErsTFnwKemo/r2jFG7mGSTz2M8zXF8 +Zr2. ~MPXŹ1)p9R9S cLzhQO0H7Lj5 \l97ܫn> From 0735ffdb69516426106e51d1a6f7a96b6c50b1fa Mon Sep 17 00:00:00 2001 From: Cilly Leang Date: Thu, 28 May 2026 23:22:19 +1000 Subject: [PATCH 12/57] containers/garnet: remove stray sv and set address to local ip --- containers/garnet/configuration.nix | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-) diff --git a/containers/garnet/configuration.nix b/containers/garnet/configuration.nix index 930ae67..4f09e34 100644 --- a/containers/garnet/configuration.nix +++ b/containers/garnet/configuration.nix @@ -8,21 +8,13 @@ networking.firewall.allowedTCPPorts = [ 9200 ]; networking.firewall.allowedUDPPorts = [ 9200 ]; - services.slskd = { - enable = true; - domain = null; - environmentFile = "/binds/slskd_env"; - settings = { - shares.directories = [ "/binds/music/" ]; - }; - }; environment.etc."opencloud-admin-pass".text = '' IDM_ADMIN_PASSWORD=supersillysecure ''; services.opencloud = { enable = true; url = "https://cloud.lava.moe"; - address = "127.0.0.1"; + address = "10.30.7.2"; port = 9200; environment = { PROXY_TLS = "false"; From 011ceee498a0c1361b662c4ffc7e01859086cdea Mon Sep 17 00:00:00 2001 From: Cilly Leang Date: Thu, 28 May 2026 23:27:19 +1000 Subject: [PATCH 13/57] containers/garnet: use ipv4 for proxy --- containers/garnet/flake.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/containers/garnet/flake.nix b/containers/garnet/flake.nix index b5e4ba5..e5bdcbc 100644 --- a/containers/garnet/flake.nix +++ b/containers/garnet/flake.nix @@ -38,7 +38,7 @@ useACMEHost = "lava.moe"; forceSSL = true; locations."/" = { - proxyPass = "http://[${client}]:9200"; + proxyPass = "http://${client4}:9200"; proxyWebsockets = true; extraConfig = '' proxy_set_header Host $host; From c4bedfd86e8bdcf9e2a58be5d96d43b4a50677a7 Mon Sep 17 00:00:00 2001 From: Cilly Leang Date: Thu, 28 May 2026 23:34:25 +1000 Subject: [PATCH 14/57] containers/garnet: move back to listen addrs --- containers/garnet/flake.nix | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) diff --git a/containers/garnet/flake.nix b/containers/garnet/flake.nix index e5bdcbc..c1694a0 100644 --- a/containers/garnet/flake.nix +++ b/containers/garnet/flake.nix @@ -44,13 +44,7 @@ proxy_set_header Host $host; ''; }; - extraConfig = '' - allow 10.0.0.0/8; - allow 100.0.0.0/8; - allow 192.168.1.0/24; - allow fd0d::/8; - deny all; - ''; + listenAddresses = [ "100.67.2.1" ]; }; systemd.tmpfiles.rules = [ From f622d5f5771d6866b7ee3b3c88ed97d4641a5c49 Mon Sep 17 00:00:00 2001 From: Cilly Leang Date: Thu, 28 May 2026 23:43:07 +1000 Subject: [PATCH 15/57] containers/garnet: try removing host header --- containers/garnet/flake.nix | 3 --- 1 file changed, 3 deletions(-) diff --git a/containers/garnet/flake.nix b/containers/garnet/flake.nix index c1694a0..29540db 100644 --- a/containers/garnet/flake.nix +++ b/containers/garnet/flake.nix @@ -40,9 +40,6 @@ locations."/" = { proxyPass = "http://${client4}:9200"; proxyWebsockets = true; - extraConfig = '' - proxy_set_header Host $host; - ''; }; listenAddresses = [ "100.67.2.1" ]; }; From 34e649e6210ced9f692e2cc300e40236c058a994 Mon Sep 17 00:00:00 2001 From: Cilly Leang Date: Fri, 29 May 2026 00:43:32 +1000 Subject: [PATCH 16/57] alyssum/filesystem: add myosotis --- hosts/alyssum/filesystem.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/hosts/alyssum/filesystem.nix b/hosts/alyssum/filesystem.nix index 205106a..bdea423 100644 --- a/hosts/alyssum/filesystem.nix +++ b/hosts/alyssum/filesystem.nix @@ -26,6 +26,7 @@ in { }; "/boot" = mkLabelMount "stem" "vfat"; + "/flower" = mkBtrfsMount "myosotis" "/@" true; "/nix" = submount "/@/nix" false; "/persist" = (submount "/@/persist" true) // { neededForBoot = true; }; "/persist/.snapshots" = submount "/snap/persist" false; From 48513690982288b4e84daf7e05db8681a1fbab4c Mon Sep 17 00:00:00 2001 From: Cilly Leang Date: Fri, 29 May 2026 00:44:13 +1000 Subject: [PATCH 17/57] containers/garnet: add hosts and correct bind mounts --- containers/garnet/configuration.nix | 12 +++++++++++- containers/garnet/flake.nix | 4 ++-- 2 files changed, 13 insertions(+), 3 deletions(-) diff --git a/containers/garnet/configuration.nix b/containers/garnet/configuration.nix index 4f09e34..ff514e8 100644 --- a/containers/garnet/configuration.nix +++ b/containers/garnet/configuration.nix @@ -1,10 +1,20 @@ { ... }: { system.stateVersion = "25.11"; fileSystems."/var/lib/opencloud" = { - device = "/persist/opencloud"; + device = "/flower/data"; fsType = "none"; options = [ "bind" ]; }; + fileSystems."/etc/opencloud" = { + device = "/persist/cfg"; + fsType = "none"; + options = [ "bind" ]; + }; + # TODO: hardcoded address + networking.extraHosts = '' + 100.67.2.1 cloud.lava.moe + ''; + networking.firewall.allowedTCPPorts = [ 9200 ]; networking.firewall.allowedUDPPorts = [ 9200 ]; diff --git a/containers/garnet/flake.nix b/containers/garnet/flake.nix index 29540db..93c3304 100644 --- a/containers/garnet/flake.nix +++ b/containers/garnet/flake.nix @@ -41,12 +41,12 @@ proxyPass = "http://${client4}:9200"; proxyWebsockets = true; }; + # TODO: hardcoded address listenAddresses = [ "100.67.2.1" ]; }; systemd.tmpfiles.rules = [ "d /persist/containers/${name} 755 root users" - "d /persist/flower 755 root users" ]; containers.${name} = { autoStart = true; @@ -67,7 +67,7 @@ isReadOnly = false; }; bindMounts."content" = { - hostPath = "/persist/flower"; + hostPath = "/flower/opencloud"; mountPoint = "/flower"; isReadOnly = false; }; From e7588e0be0ec335a262f37f3c96f2af4031b132d Mon Sep 17 00:00:00 2001 From: Cilly Leang Date: Sat, 30 May 2026 21:24:30 +1000 Subject: [PATCH 18/57] {system,rin}/packages: cleanup --- modules/system/packages.nix | 1 - users/rin/packages.nix | 37 ++++++++++++++++--------------------- 2 files changed, 16 insertions(+), 22 deletions(-) diff --git a/modules/system/packages.nix b/modules/system/packages.nix index afeef4e..d4e2e3c 100644 --- a/modules/system/packages.nix +++ b/modules/system/packages.nix @@ -16,7 +16,6 @@ neovim nfs-utils ntfs3g - oci-cli ripgrep rsync sshfs diff --git a/users/rin/packages.nix b/users/rin/packages.nix index 8b15c60..0916865 100644 --- a/users/rin/packages.nix +++ b/users/rin/packages.nix @@ -19,15 +19,28 @@ in { nodejs_latest pamixer pnpm - qmk unrar - weechat yt-dlp + ] ++ lib.optionals (config.me.environment == "desktop") [ + krita + lutris + mangohud + (prismlauncher.override { + jdks = [ + jdk21 + temurin-bin-25 + ]; + }) + inputs.nix-gaming.packages.x86_64-linux.osu-lazer-bin + qmk + tetrio-desktop + tor-browser + virt-manager + winetricks ] ++ lib.optionals config.me.gui [ android-studio brightnessctl drawio - element-desktop evince eww feh @@ -36,37 +49,19 @@ in { gamescope gimp3 grim - jetbrains.gateway - #kotatogram-desktop - krita lm_sensors - lutris - insomnia maim - mangohud me.psensor - inputs.nix-gaming.packages.x86_64-linux.osu-lazer-bin - # inputs.nix-gaming.packages.x86_64-linux.wine-osu obsidian pavucontrol - (prismlauncher.override { - jdks = [ - jdk21 - temurin-bin-25 - ]; - }) qbittorrent rivalcfg screenkey slurp swaybg - tetrio-desktop texliveFull - tor-browser transmission-remote-gtk vesktop - virt-manager - winetricks zathura zenity From cc2e9d1a90da5b9e16da55a864cd07deec24b727 Mon Sep 17 00:00:00 2001 From: Cilly Leang Date: Sun, 31 May 2026 02:15:37 +1000 Subject: [PATCH 19/57] user/eww: use iwd tools instead of nmcli --- modules/user/eww.nix | 2 +- res/eww/eww.yuck | 28 +++++++++++++++------------- res/eww/scripts/network.sh | 19 ------------------- 3 files changed, 16 insertions(+), 33 deletions(-) delete mode 100755 res/eww/scripts/network.sh diff --git a/modules/user/eww.nix b/modules/user/eww.nix index fa5fd4e..13db70e 100644 --- a/modules/user/eww.nix +++ b/modules/user/eww.nix @@ -21,7 +21,7 @@ let ''; }; in { - home.packages = with pkgs; [ socat ]; + home.packages = with pkgs; [ iw socat ]; programs.eww = { enable = true; }; diff --git a/res/eww/eww.yuck b/res/eww/eww.yuck index 2598788..d72a2cc 100644 --- a/res/eww/eww.yuck +++ b/res/eww/eww.yuck @@ -1,4 +1,5 @@ (defwindow mainbar :monitor 0 + :geometry (geometry :x "0%" :y "0%" :width "100%" @@ -39,14 +40,15 @@ `cat /sys/class/power_supply/_BAT_PATH_/capacity`) (defpoll pbat_status :interval "1s" :run-while bat-enabled `cat /sys/class/power_supply/_BAT_PATH_/status`) -(defpoll network_strength :interval "1s" :run-while wifi-enabled - `nmcli -f IN-USE,SIGNAL device wifi | grep '*' | tr -d -c 0-9`) +(defpoll wifi_ssid :interval "1s" :run-while wifi-enabled + `iwctl station wlan0 show | grep "Connected network" | awk '{print $3}'`) +(defpoll wifi_strength :interval "1s" :run-while wifi-enabled + `iw dev wlan0 link | awk '/signal/ {gsub("-",""); print $2}'`) (defpoll bluetooth_device :interval "1s" :run-while bt-enabled `bluetoothctl devices Connected | grep Device | cut -d" " -f3-`) (defpoll bluetooth_device_count :interval "1s" :run-while bt-enabled `bluetoothctl devices Connected | wc -l`) -(deflisten lnetwork :initial "" :run-while wifi-enabled "./scripts/network.sh") (deflisten ltitle :initial "" "./scripts/title.sh") (deflisten lworkspaces :initial "[]" "./scripts/workspaces.sh") (deflisten lcurrent_workspace :initial "1" "./scripts/active-workspace.sh") @@ -107,22 +109,22 @@ (defwidget network [] (button :onclick `eww update network-extended=${network-extended ? "false" : "true"}` (box :orientation "horizontal" - :class {"widget pill" + ((network-extended && lnetwork != "Disconnected") ? " extended" : "")} - :spacing {(network-extended && lnetwork != "Disconnected") ? 5 : 0} + :class {"widget pill" + ((network-extended && wifi_ssid != "") ? " extended" : "")} + :spacing {(network-extended && wifi_ssid != "") ? 5 : 0} :space-evenly false (label :text { - (lnetwork == "Disconnected") ? "" - : (network_strength == "") ? "" - : (network_strength < 20) ? "" - : (network_strength < 30) ? "" - : (network_strength < 55) ? "" - : (network_strength < 80) ? "" + (wifi_ssid == "") ? "" + : (wifi_strength == "") ? "" + : (wifi_strength < 75) ? "" + : (wifi_strength < 65) ? "" + : (wifi_strength < 60) ? "" + : (wifi_strength < 50) ? "" : ""} :class "base pill-icon") (revealer :transition "slideleft" - :reveal {network-extended && lnetwork != "Disconnected"} + :reveal {network-extended && wifi_ssid != ""} :duration 150 - (label :text lnetwork + (label :text wifi_ssid :class "base"))))) (defwidget battery [] diff --git a/res/eww/scripts/network.sh b/res/eww/scripts/network.sh deleted file mode 100755 index 7d0c2c8..0000000 --- a/res/eww/scripts/network.sh +++ /dev/null @@ -1,19 +0,0 @@ -#!/usr/bin/env bash - -init=$(nmcli -t -f name,device connection show --active | grep wlp1s0 | cut -d\: -f1) - -if [[ -z $init ]]; then - echo Disconnected -else - echo $init -fi - -nmcli monitor | while read -r line ; do - if [[ $line == *"is now the primary connection" ]]; then - conn=$(echo $line | cut -d\' -f2) - echo $conn - fi - if [[ $line == "There's no primary connection" ]]; then - echo Disconnected - fi -done From 93354e641927c07672e32cd453be5b4c1394a762 Mon Sep 17 00:00:00 2001 From: Cilly Leang Date: Tue, 2 Jun 2026 19:50:01 +1000 Subject: [PATCH 20/57] containers/citrine: garden -> lab --- containers/citrine/configuration.nix | 2 +- containers/citrine/flake.nix | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/containers/citrine/configuration.nix b/containers/citrine/configuration.nix index 996ffb2..392062c 100644 --- a/containers/citrine/configuration.nix +++ b/containers/citrine/configuration.nix @@ -11,7 +11,7 @@ enable = true; lfs.enable = true; settings = { - DEFAULT.APP_NAME = "Garden"; + DEFAULT.APP_NAME = "cilly's botanical laboratory"; server = { DOMAIN = fqdn; ROOT_URL = "https://${fqdn}/"; diff --git a/containers/citrine/flake.nix b/containers/citrine/flake.nix index 5673c9e..c2a81b7 100644 --- a/containers/citrine/flake.nix +++ b/containers/citrine/flake.nix @@ -6,7 +6,7 @@ outputs = { nixpkgs, catppuccin, ... }: let name = "citrine"; - fqdn = "garden.lava.moe"; + fqdn = "lab.lava.moe"; subnetId = "3"; subnet = x: "fd0d:1::${subnetId}:${toString x}"; From 91abcbed1984e86981e95b395202e240ed13fbf7 Mon Sep 17 00:00:00 2001 From: Cilly Leang Date: Tue, 2 Jun 2026 19:54:09 +1000 Subject: [PATCH 21/57] services/banksia: redirect to lab --- modules/services/banksia.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/services/banksia.nix b/modules/services/banksia.nix index d6532f6..2ace618 100644 --- a/modules/services/banksia.nix +++ b/modules/services/banksia.nix @@ -4,7 +4,7 @@ "banksia.lava.moe" = { useACMEHost = "lava.moe"; forceSSL = true; - locations."/".return = "302 https://github.com/cillynder/Banksia"; + locations."/".return = "302 https://lab.lava.moe/cilly/Banksia"; locations."/api".proxyPass = "http://localhost:8080/"; }; }; From ee3e0868a8338ab92d34a434e9c3add7dca3db5d Mon Sep 17 00:00:00 2001 From: Cilly Leang Date: Sat, 6 Jun 2026 20:14:37 +1000 Subject: [PATCH 22/57] system/tailscale: loosen firewall for tailnet --- modules/system/tailscale.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/modules/system/tailscale.nix b/modules/system/tailscale.nix index 732a9bb..02bce52 100644 --- a/modules/system/tailscale.nix +++ b/modules/system/tailscale.nix @@ -1,6 +1,7 @@ { config, ... }: { age.secrets.tailscale_auth.file = ../../secrets/tailscale_auth.age; me.binds."/var/lib/tailscale" = "tailscale"; + networking.firewall.trustedInterfaces = [ "tailscale0" ]; services.tailscale = { enable = true; authKeyFile = config.age.secrets.tailscale_auth.path; From abe0027e5dc405174f7d8993db14e57cadda7b29 Mon Sep 17 00:00:00 2001 From: Cilly Leang Date: Sat, 6 Jun 2026 20:23:56 +1000 Subject: [PATCH 23/57] hosts/alyssum: add syncthing --- hosts/alyssum/default.nix | 4 +++- modules/services/syncthing.nix | 2 +- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/hosts/alyssum/default.nix b/hosts/alyssum/default.nix index 9a53926..3eb7289 100644 --- a/hosts/alyssum/default.nix +++ b/hosts/alyssum/default.nix @@ -1,4 +1,4 @@ -{ inputs, modules, modulesPath, ... }: { +{ inputs, lib, modules, modulesPath, ... }: { networking.hostName = "alyssum"; system.stateVersion = "25.11"; time.timeZone = "Australia/Melbourne"; @@ -24,6 +24,7 @@ tailscale modules.services.nginx + modules.services.syncthing inputs.c-garnet.nixosModule @@ -35,4 +36,5 @@ ]; me.environment = "headless"; + services.syncthing.user = lib.mkForce "hana"; } diff --git a/modules/services/syncthing.nix b/modules/services/syncthing.nix index 2316f9f..d27f911 100644 --- a/modules/services/syncthing.nix +++ b/modules/services/syncthing.nix @@ -1,7 +1,7 @@ { config, ... }: let dir = "/persist/shared/.syncthing"; - uid = toString config.users.users.rin.uid; + uid = toString config.services.syncthing.user; gid = toString config.users.groups.users.gid; in { From 72078aad6c6142b84c873ceafbad4a6ea464ede7 Mon Sep 17 00:00:00 2001 From: Cilly Leang Date: Sat, 6 Jun 2026 20:33:19 +1000 Subject: [PATCH 24/57] services/syncthing: listen on all ports for headless --- modules/services/syncthing.nix | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/modules/services/syncthing.nix b/modules/services/syncthing.nix index d27f911..8ec331b 100644 --- a/modules/services/syncthing.nix +++ b/modules/services/syncthing.nix @@ -1,7 +1,8 @@ { config, ... }: let dir = "/persist/shared/.syncthing"; - uid = toString config.services.syncthing.user; + user = if config.me.gui then "rin" else "hana"; + uid = toString config.users.users."${user}".uid; gid = toString config.users.groups.users.gid; in { @@ -13,9 +14,10 @@ in services.syncthing = { enable = true; openDefaultPorts = true; - user = "rin"; + user = user; group = "users"; dataDir = "/persist/shared/.syncthing/data"; configDir = "/persist/shared/.syncthing/config"; + guiAddress = if config.me.gui then "127.0.0.1:8384" else ""; }; } From 1ad05857b7566f15575dd03d09f31da80669744d Mon Sep 17 00:00:00 2001 From: Cilly Leang Date: Sat, 6 Jun 2026 20:35:10 +1000 Subject: [PATCH 25/57] services/syncthing: setup correct guiAddress --- modules/services/syncthing.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/services/syncthing.nix b/modules/services/syncthing.nix index 8ec331b..db32371 100644 --- a/modules/services/syncthing.nix +++ b/modules/services/syncthing.nix @@ -18,6 +18,6 @@ in group = "users"; dataDir = "/persist/shared/.syncthing/data"; configDir = "/persist/shared/.syncthing/config"; - guiAddress = if config.me.gui then "127.0.0.1:8384" else ""; + guiAddress = if config.me.gui then "127.0.0.1:8384" else ":8384"; }; } From 9a87dc63c3f2cdd80c5918ff61864471e6186cc3 Mon Sep 17 00:00:00 2001 From: Cilly Leang Date: Fri, 5 Jun 2026 00:12:18 +1000 Subject: [PATCH 26/57] rin/packages: move prism back to shared gui --- users/rin/packages.nix | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/users/rin/packages.nix b/users/rin/packages.nix index 0916865..afc711b 100644 --- a/users/rin/packages.nix +++ b/users/rin/packages.nix @@ -25,12 +25,6 @@ in { krita lutris mangohud - (prismlauncher.override { - jdks = [ - jdk21 - temurin-bin-25 - ]; - }) inputs.nix-gaming.packages.x86_64-linux.osu-lazer-bin qmk tetrio-desktop @@ -54,6 +48,12 @@ in { me.psensor obsidian pavucontrol + (prismlauncher.override { + jdks = [ + jdk21 + temurin-bin-25 + ]; + }) qbittorrent rivalcfg screenkey From 8ca9e393ea1b9d89d49d44d8c2af4bfd4b5aaac0 Mon Sep 17 00:00:00 2001 From: Cilly Leang Date: Fri, 5 Jun 2026 00:16:15 +1000 Subject: [PATCH 27/57] system/input: swap esc using keyd --- modules/system/input.nix | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/modules/system/input.nix b/modules/system/input.nix index 2ef1eab..44da34b 100644 --- a/modules/system/input.nix +++ b/modules/system/input.nix @@ -6,7 +6,18 @@ "-arinterval 15" ]; }; - xkb.options = "caps:escape"; }; - console.useXkbConfig = true; + services.keyd = { + enable = true; + keyboards = { + default = { + ids = [ "*" ]; + settings = { + main = { + capslock = "overload(control, esc)"; + }; + }; + }; + }; + }; } From 9a6a29831b751dd2a6bb15bf26e6174ebc5ffe8b Mon Sep 17 00:00:00 2001 From: Cilly Leang Date: Fri, 5 Jun 2026 00:18:29 +1000 Subject: [PATCH 28/57] system/security: reenable doas persist --- modules/system/security.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/system/security.nix b/modules/system/security.nix index 3b4e8a7..f1f087b 100644 --- a/modules/system/security.nix +++ b/modules/system/security.nix @@ -49,7 +49,7 @@ { groups = [ "wheel" ]; keepEnv = true; - persist = config.me.environment != "laptop"; + persist = true; } ]; }; From 8a85e25d720376b4e8dc4bcdfcbc39d549ce008e Mon Sep 17 00:00:00 2001 From: Cilly Leang Date: Fri, 5 Jun 2026 00:20:29 +1000 Subject: [PATCH 29/57] system/input: don't overload capslock input delay :p --- modules/system/input.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/system/input.nix b/modules/system/input.nix index 44da34b..67b1a96 100644 --- a/modules/system/input.nix +++ b/modules/system/input.nix @@ -14,7 +14,7 @@ ids = [ "*" ]; settings = { main = { - capslock = "overload(control, esc)"; + capslock = "esc"; }; }; }; From ea17ef30c609d67155a61579a27fac460112feaa Mon Sep 17 00:00:00 2001 From: Cilly Leang Date: Fri, 5 Jun 2026 00:22:49 +1000 Subject: [PATCH 30/57] system/input: map esc to capslock --- modules/system/input.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/modules/system/input.nix b/modules/system/input.nix index 67b1a96..a0bf2ff 100644 --- a/modules/system/input.nix +++ b/modules/system/input.nix @@ -15,6 +15,7 @@ settings = { main = { capslock = "esc"; + esc = "capslock"; }; }; }; From 75f9cc9d2bdd32fbcb1e28b7a300d61fc04da2b3 Mon Sep 17 00:00:00 2001 From: Cilly Leang Date: Wed, 10 Jun 2026 15:05:05 +1000 Subject: [PATCH 31/57] system/tailscale: open port 123 on headless --- modules/system/tailscale.nix | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/modules/system/tailscale.nix b/modules/system/tailscale.nix index 02bce52..e7e6e0c 100644 --- a/modules/system/tailscale.nix +++ b/modules/system/tailscale.nix @@ -1,7 +1,9 @@ -{ config, ... }: { +{ config, lib, ... }: { age.secrets.tailscale_auth.file = ../../secrets/tailscale_auth.age; me.binds."/var/lib/tailscale" = "tailscale"; networking.firewall.trustedInterfaces = [ "tailscale0" ]; + networking.firewall.allowedUdpPorts = lib.mkIf config.me.environment == "headless" [ 123 ]; + services.tailscale = { enable = true; authKeyFile = config.age.secrets.tailscale_auth.path; From b705a21478d057b5bcbebd24ac5ffd3652e747c7 Mon Sep 17 00:00:00 2001 From: Cilly Leang Date: Wed, 10 Jun 2026 15:06:38 +1000 Subject: [PATCH 32/57] system/tailscale: fix syntax --- modules/system/tailscale.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/system/tailscale.nix b/modules/system/tailscale.nix index e7e6e0c..5e3e044 100644 --- a/modules/system/tailscale.nix +++ b/modules/system/tailscale.nix @@ -2,7 +2,7 @@ age.secrets.tailscale_auth.file = ../../secrets/tailscale_auth.age; me.binds."/var/lib/tailscale" = "tailscale"; networking.firewall.trustedInterfaces = [ "tailscale0" ]; - networking.firewall.allowedUdpPorts = lib.mkIf config.me.environment == "headless" [ 123 ]; + networking.firewall.allowedUDPPorts = lib.mkIf (config.me.environment == "headless") [ 123 ]; services.tailscale = { enable = true; From 29909729897e4085370656f6ab19f8d280fafbbf Mon Sep 17 00:00:00 2001 From: Cilly Leang Date: Wed, 10 Jun 2026 16:01:23 +1000 Subject: [PATCH 33/57] user/git: set default branch name --- modules/user/git.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/modules/user/git.nix b/modules/user/git.nix index 6c21f20..ca2762e 100644 --- a/modules/user/git.nix +++ b/modules/user/git.nix @@ -10,6 +10,7 @@ user.email = "mini@cilly.moe"; core.abbrev = 11; safe.directory = "/home/rin/Projects/flakes"; + init.defaultBranch = "master"; }; }; } From 37f271bed8d08dc44b47620d47f5142e4f81202e Mon Sep 17 00:00:00 2001 From: Cilly Leang Date: Wed, 10 Jun 2026 16:05:24 +1000 Subject: [PATCH 34/57] containers/citrine: enable push to create --- containers/citrine/configuration.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/containers/citrine/configuration.nix b/containers/citrine/configuration.nix index 392062c..0f4242a 100644 --- a/containers/citrine/configuration.nix +++ b/containers/citrine/configuration.nix @@ -34,6 +34,8 @@ }; api.ENABLE_SWAGGER = false; other.SHOW_FOOTER_TEMPLATE_LOAD_TIME = false; + repository.ENABLE_PUSH_CREATE_USER = true; + repository.ENABLE_PUSH_CREATE_ORG = true; service.DISABLE_REGISTRATION = true; }; stateDir = "/persist/forgejo"; From 6fc74bd778317c578b8c7532056dfcd469514475 Mon Sep 17 00:00:00 2001 From: Cilly Leang Date: Tue, 9 Jun 2026 18:15:04 +1000 Subject: [PATCH 35/57] hosts/hyacinth: add docker --- hosts/hyacinth/default.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/hosts/hyacinth/default.nix b/hosts/hyacinth/default.nix index c307ce8..a32d4bd 100644 --- a/hosts/hyacinth/default.nix +++ b/hosts/hyacinth/default.nix @@ -18,6 +18,7 @@ bluetooth ccache corectrl + docker flatpak greetd gui From e98a71cd1ed09eb93a39e5cb1be797b620a4f9aa Mon Sep 17 00:00:00 2001 From: Cilly Leang Date: Sat, 13 Jun 2026 22:12:32 +1000 Subject: [PATCH 36/57] containers/garnet: config nginx to avoid errors --- containers/garnet/flake.nix | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/containers/garnet/flake.nix b/containers/garnet/flake.nix index 93c3304..df835a4 100644 --- a/containers/garnet/flake.nix +++ b/containers/garnet/flake.nix @@ -41,6 +41,13 @@ proxyPass = "http://${client4}:9200"; proxyWebsockets = true; }; + extraConfig = '' + proxy_read_timeout 3600s; + proxy_send_timeout 3600s; + keepalive_requests 100000; + keepalive_timeout 5m; + http2_max_concurrent_streams 512; + ''; # TODO: hardcoded address listenAddresses = [ "100.67.2.1" ]; }; From 2a9e8e6c0372c1eacb9fd91a062acd9c657be694 Mon Sep 17 00:00:00 2001 From: Cilly Leang Date: Sat, 13 Jun 2026 23:44:29 +1000 Subject: [PATCH 37/57] containers/garnet: extend token expiration --- containers/garnet/configuration.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/containers/garnet/configuration.nix b/containers/garnet/configuration.nix index ff514e8..21400c5 100644 --- a/containers/garnet/configuration.nix +++ b/containers/garnet/configuration.nix @@ -28,6 +28,8 @@ port = 9200; environment = { PROXY_TLS = "false"; + IDP_ACCESS_TOKEN_EXPIRATION = "2592000"; + IDP_ID_TOKEN_EXPIRATION = "2592000"; }; environmentFile = "/etc/opencloud-admin-pass"; }; From 402c847f3cd7f457e7946b4b3431a71a47963828 Mon Sep 17 00:00:00 2001 From: Cilly Leang Date: Sun, 14 Jun 2026 20:32:32 +1000 Subject: [PATCH 38/57] dandelion/filesystem: reduce rootfs from 12G to 6G --- hosts/dandelion/filesystem.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hosts/dandelion/filesystem.nix b/hosts/dandelion/filesystem.nix index 4dd6a55..861bc15 100644 --- a/hosts/dandelion/filesystem.nix +++ b/hosts/dandelion/filesystem.nix @@ -22,7 +22,7 @@ in { "/" = { device = "rootfs"; fsType = "tmpfs"; - options = [ "defaults" "size=12G" "mode=755" ]; + options = [ "defaults" "size=6G" "mode=755" ]; }; "/boot" = mkLabelMount "UEFI" "vfat"; From d1a8e7222f0dd930f945a4f101cd885ce6001357 Mon Sep 17 00:00:00 2001 From: Cilly Leang Date: Wed, 17 Jun 2026 18:11:09 +1000 Subject: [PATCH 39/57] alyssum/samba: init --- hosts/alyssum/default.nix | 1 + hosts/alyssum/samba.nix | 81 +++++++++++++++++++++++++++++++++++++++ 2 files changed, 82 insertions(+) create mode 100644 hosts/alyssum/samba.nix diff --git a/hosts/alyssum/default.nix b/hosts/alyssum/default.nix index 3eb7289..d471011 100644 --- a/hosts/alyssum/default.nix +++ b/hosts/alyssum/default.nix @@ -31,6 +31,7 @@ ./filesystem.nix ./kernel.nix ./networking.nix + ./samba.nix ../../users/hana ]; diff --git a/hosts/alyssum/samba.nix b/hosts/alyssum/samba.nix new file mode 100644 index 0000000..9e957e9 --- /dev/null +++ b/hosts/alyssum/samba.nix @@ -0,0 +1,81 @@ +{ config, ... }: { + networking.firewall.allowPing = true; + + users.users.cilly = { + hashedPasswordFile = config.age.secrets.passwd.path; + isNormalUser = true; + }; + users.users.kujira = { + hashedPasswordFile = config.age.secrets.passwd.path; + isNormalUser = true; + }; + system.activationScripts = { + init_smbpasswd.text = '' + /run/current-system/sw/bin/printf "$(/run/current-system/sw/bin/cat ${config.age.secrets.passwd.path})\n$(/run/current-system/sw/bin/cat ${config.age.secrets.passwd.path})\n" | /run/current-system/sw/bin/smbpasswd -sa cilly + + /run/current-system/sw/bin/printf "$(/run/current-system/sw/bin/cat ${config.age.secrets.passwd_kujira.path})\n$(/run/current-system/sw/bin/cat ${config.age.secrets.passwd_kujira.path})\n" | /run/current-system/sw/bin/smbpasswd -sa kujira + ''; + }; + + services.samba = { + enable = true; + openFirewall = true; + settings = { + global = { + "workgroup" = "WORKGROUP"; + "server string" = "smbnix"; + "netbios name" = "smbnix"; + "security" = "user"; + "hosts allow" = "100.67.2.1 127.0.0.1 localhost"; + "hosts deny" = "0.0.0.0/0"; + "guest account" = "nobody"; + "map to guest" = "bad user"; + }; + "public" = { + "path" = "/flower/smb/public"; + "browseable" = "yes"; + "read only" = "no"; + "guest ok" = "yes"; + "create mask" = "0644"; + "directory mask" = "0755"; + "force user" = "hana"; + "force group" = "users"; + }; + "cilly" = { + "path" = "/flower/smb/cilly"; + "browseable" = "yes"; + "read only" = "no"; + "guest ok" = "no"; + "create mask" = "0644"; + "directory mask" = "0755"; + "force user" = "cilly"; + "force group" = "users"; + "valid users" = "cilly"; + }; + "kujira" = { + "path" = "/flower/smb/kujira"; + "browseable" = "yes"; + "read only" = "no"; + "guest ok" = "no"; + "create mask" = "0644"; + "directory mask" = "0755"; + "force user" = "kujira"; + "force group" = "users"; + "valid users" = "kujira"; + }; + }; + }; + + services.samba-wsdd = { + enable = true; + openFirewall = true; + }; + + services.avahi = { + enable = true; + openFirewall = true; + nssmdns4 = true; + publish.enable = true; + publish.userServices = true; + }; +} From 4f8249b780b00add8a8a8d22543a54229faa696d Mon Sep 17 00:00:00 2001 From: Cilly Leang Date: Wed, 17 Jun 2026 18:16:21 +1000 Subject: [PATCH 40/57] alyssum/samba: use proper credentials --- hosts/alyssum/samba.nix | 7 +++++-- secrets.nix | 2 ++ secrets/passwd_smbcilly.age | 7 +++++++ secrets/passwd_smbkujira.age | 7 +++++++ 4 files changed, 21 insertions(+), 2 deletions(-) create mode 100644 secrets/passwd_smbcilly.age create mode 100644 secrets/passwd_smbkujira.age diff --git a/hosts/alyssum/samba.nix b/hosts/alyssum/samba.nix index 9e957e9..6be8e09 100644 --- a/hosts/alyssum/samba.nix +++ b/hosts/alyssum/samba.nix @@ -1,6 +1,9 @@ { config, ... }: { networking.firewall.allowPing = true; + age.secrets.passwd_smbcilly.file = ../../secrets/passwd_smbcilly.age; + age.secrets.passwd_smbkujira.file = ../../secrets/passwd_smbkujira.age; + users.users.cilly = { hashedPasswordFile = config.age.secrets.passwd.path; isNormalUser = true; @@ -11,9 +14,9 @@ }; system.activationScripts = { init_smbpasswd.text = '' - /run/current-system/sw/bin/printf "$(/run/current-system/sw/bin/cat ${config.age.secrets.passwd.path})\n$(/run/current-system/sw/bin/cat ${config.age.secrets.passwd.path})\n" | /run/current-system/sw/bin/smbpasswd -sa cilly + /run/current-system/sw/bin/printf "$(/run/current-system/sw/bin/cat ${config.age.secrets.passwd_smbcilly.path})\n$(/run/current-system/sw/bin/cat ${config.age.secrets.passwd_smbcilly.path})\n" | /run/current-system/sw/bin/smbpasswd -sa cilly - /run/current-system/sw/bin/printf "$(/run/current-system/sw/bin/cat ${config.age.secrets.passwd_kujira.path})\n$(/run/current-system/sw/bin/cat ${config.age.secrets.passwd_kujira.path})\n" | /run/current-system/sw/bin/smbpasswd -sa kujira + /run/current-system/sw/bin/printf "$(/run/current-system/sw/bin/cat ${config.age.secrets.passwd_smbkujira.path})\n$(/run/current-system/sw/bin/cat ${config.age.secrets.passwd_smbkujira.path})\n" | /run/current-system/sw/bin/smbpasswd -sa kujira ''; }; diff --git a/secrets.nix b/secrets.nix index d2dbc82..ec20648 100644 --- a/secrets.nix +++ b/secrets.nix @@ -8,6 +8,8 @@ let rin = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPru5eTBvHJ4ZmrrzPRHCGM09wQP/ZHSaKYalDuBVO15"; in { "secrets/passwd.age".publicKeys = [ anemone blossom rin ]; + "secrets/passwd_smbcilly.age".publicKeys = [ alyssum rin ]; + "secrets/passwd_smbkujira.age".publicKeys = [ alyssum rin ]; "secrets/wpa_conf.age".publicKeys = [ alyssum blossom rin ]; "secrets/acme_dns.age".publicKeys = [ alyssum dandelion hazel rin ]; diff --git a/secrets/passwd_smbcilly.age b/secrets/passwd_smbcilly.age new file mode 100644 index 0000000..41ad172 --- /dev/null +++ b/secrets/passwd_smbcilly.age @@ -0,0 +1,7 @@ +age-encryption.org/v1 +-> ssh-ed25519 kOMSPw CQaXT9/nw3NGD2/H/ctSQGXIoacgjfKQ24wkpEieLSQ +i4xEXgWGQ7xgQyaDQQIeDuiCLjA6Le23qSnv8C1cbcI +-> ssh-ed25519 U9FXlg GL4dCSCku/FA6ipb9XI1AxO4lhm2r/1lRAeqaGrB32o ++pPgqwnoPi3wJLobTimVMj0rng+XRapRG6jTYFXSsDM +--- eVgn3ON19pqq+L832bqlbkHUQXdaTI+LfSL4bYfEdew +*l\W!J7E/"f@%\[j8fӶ \ No newline at end of file diff --git a/secrets/passwd_smbkujira.age b/secrets/passwd_smbkujira.age new file mode 100644 index 0000000..71b6bb8 --- /dev/null +++ b/secrets/passwd_smbkujira.age @@ -0,0 +1,7 @@ +age-encryption.org/v1 +-> ssh-ed25519 kOMSPw Kn+LPMoyOrVwI/nrGgnxgVA3D+tVY9Tccg/Yx/jL+E8 +IfWiSBh7KgNvgcHlcDzfdcB9nxm1zy12Ae7AGm39fdE +-> ssh-ed25519 U9FXlg 6eIIGEIYDo02FBsgBnwbuOeR8t4xB6jSmLfIL73UCDg +QOc0ddunQQcVEVD20DKKpn3wZWUSveFJSUTBnv+xnNk +--- MjN2i0FNzbUpBGUDNgWGXrRsYl2gtsQX+JlzZV/fYdw +T <R#d Ć̎lLkN8c_N)T \ No newline at end of file From c782bd5e5398534f81214e3bced2aa73e08e10b6 Mon Sep 17 00:00:00 2001 From: Cilly Leang Date: Wed, 17 Jun 2026 18:23:10 +1000 Subject: [PATCH 41/57] hosts/alyssum: add passwd age --- hosts/alyssum/default.nix | 1 + secrets.nix | 2 +- secrets/passwd.age | Bin 531 -> 641 bytes 3 files changed, 2 insertions(+), 1 deletion(-) diff --git a/hosts/alyssum/default.nix b/hosts/alyssum/default.nix index d471011..a2eb166 100644 --- a/hosts/alyssum/default.nix +++ b/hosts/alyssum/default.nix @@ -5,6 +5,7 @@ age.secrets = { acme_dns.file = ../../secrets/acme_dns.age; + passwd.file = ../../secrets/passwd.age; wpa_conf = { file = ../../secrets/wpa_conf.age; path = "/etc/wpa_supplicant/imperative.conf"; diff --git a/secrets.nix b/secrets.nix index ec20648..bec70ef 100644 --- a/secrets.nix +++ b/secrets.nix @@ -7,7 +7,7 @@ let rin = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPru5eTBvHJ4ZmrrzPRHCGM09wQP/ZHSaKYalDuBVO15"; in { - "secrets/passwd.age".publicKeys = [ anemone blossom rin ]; + "secrets/passwd.age".publicKeys = [ alyssum anemone blossom rin ]; "secrets/passwd_smbcilly.age".publicKeys = [ alyssum rin ]; "secrets/passwd_smbkujira.age".publicKeys = [ alyssum rin ]; "secrets/wpa_conf.age".publicKeys = [ alyssum blossom rin ]; diff --git a/secrets/passwd.age b/secrets/passwd.age index 64ec8611ddf1a1d3f837caf32b53d5843f7b6e07..05ad90670240bfe01391eb8392cd02ad35d1c5bd 100644 GIT binary patch delta 596 zcmbQt(#SeNwLaV5H#neNp(s2%!q_7?$j7C~J=oCKE5oy-BsrwWr64rBz`L|8y{an9 zBFsIqJm0{8D>c(3I5)q`JxHv;MHO0u()X-8PKch0Z#8DyB*uU7sB+Dr%qdv>Az{ywJ$H~awsl?ATEYZ}- zBq+}^uh=leG%DSrIIEm1IU~@_EZfLm-?Yp-P~XEi)LTEepwcm{(l;|J)vYQZF*m9x zwA9fk-OUx93pU|@G%n*z02+xqv4C6e*?2M97@1TsTVAr(597AoN#E=5_%7_xz zi66!5J)J#+EP_p{d>vCFGLt>bjXbKnQd0xd($cd0LNdyNU9#PiEz`1tyaNNda*B*A zTrb|^HnZYzWY=cufpN-;@7gMf=O#Hn1hI;KPb=lf^lIPl6HZS=2L%5*v`cv-> YJkH)xEW9(@zeyiIH`!pOX{Em>0JK!tjsO4v delta 466 zcmZok^FqSVba!Z-*7L(g6wo-1M{@Z+(1XJlyqb7 zC~r^0#MI365OWKE9}mkM^YUg2CC+YMPLZVn zmM&3=UdH9x#W}ui8Low<-e!R*kxo&L1}Q$;fx(uhk3$ZDUR4EYCYcqMr3R5)y1Kdweg%1!i558-K1JHW+FmBw<%#8y zegP(CCdr9;CN6%V`N`(>N#@}Jt|g%+To*((7~f_+q00A8b`fLhp}Xt*if!Dl#T{c2 zE_hU5lHW2pfMsudL!P8U<-)y>#9xJKr5oAp;QEw$;d8I0!J~UpO?>m(ioP9UQxcqb zdDVFa?#j+-DXlZDYLD)8&D4Iu%zD>h!HX%(zs|p!7N2uW{HitM>x2#5(|Mgg3b4ye MK7Ppl$Cj<;0P3%*4gdfE From 509684d0bd094bd96fcef03ceacba6be33446a63 Mon Sep 17 00:00:00 2001 From: Cilly Leang Date: Wed, 17 Jun 2026 18:28:39 +1000 Subject: [PATCH 42/57] alyssum/samba: use proper smbpasswd path --- hosts/alyssum/samba.nix | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/hosts/alyssum/samba.nix b/hosts/alyssum/samba.nix index 6be8e09..ba89a00 100644 --- a/hosts/alyssum/samba.nix +++ b/hosts/alyssum/samba.nix @@ -13,10 +13,12 @@ isNormalUser = true; }; system.activationScripts = { - init_smbpasswd.text = '' - /run/current-system/sw/bin/printf "$(/run/current-system/sw/bin/cat ${config.age.secrets.passwd_smbcilly.path})\n$(/run/current-system/sw/bin/cat ${config.age.secrets.passwd_smbcilly.path})\n" | /run/current-system/sw/bin/smbpasswd -sa cilly + init_smbpasswd.text = let + smbpasswd = "${config.services.samba.package}/bin/smbpasswd"; + in '' + printf "$(cat ${config.age.secrets.passwd_smbcilly.path})\n$(cat ${config.age.secrets.passwd_smbcilly.path})\n" | ${smbpasswd} -sa cilly - /run/current-system/sw/bin/printf "$(/run/current-system/sw/bin/cat ${config.age.secrets.passwd_smbkujira.path})\n$(/run/current-system/sw/bin/cat ${config.age.secrets.passwd_smbkujira.path})\n" | /run/current-system/sw/bin/smbpasswd -sa kujira + printf "$(cat ${config.age.secrets.passwd_smbkujira.path})\n$(cat ${config.age.secrets.passwd_smbkujira.path})\n" | ${smbpasswd} -sa kujira ''; }; From 4bb20124a791bdce70acdd4bdcfe1a2eb4acacb6 Mon Sep 17 00:00:00 2001 From: Cilly Leang Date: Wed, 17 Jun 2026 18:34:34 +1000 Subject: [PATCH 43/57] alyssum/samba: use full package for discovery --- hosts/alyssum/samba.nix | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/hosts/alyssum/samba.nix b/hosts/alyssum/samba.nix index ba89a00..708286a 100644 --- a/hosts/alyssum/samba.nix +++ b/hosts/alyssum/samba.nix @@ -1,4 +1,4 @@ -{ config, ... }: { +{ config, pkgs, ... }: { networking.firewall.allowPing = true; age.secrets.passwd_smbcilly.file = ../../secrets/passwd_smbcilly.age; @@ -24,9 +24,11 @@ services.samba = { enable = true; + package = pkgs.samba4Full; openFirewall = true; settings = { global = { + "server smb encrypt" = "required"; "workgroup" = "WORKGROUP"; "server string" = "smbnix"; "netbios name" = "smbnix"; From 024a6bdbe2f56232d63c2f62b20bf509b65f7fb0 Mon Sep 17 00:00:00 2001 From: Cilly Leang Date: Wed, 17 Jun 2026 18:47:15 +1000 Subject: [PATCH 44/57] alyssum/samba: relax hosts --- hosts/alyssum/samba.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hosts/alyssum/samba.nix b/hosts/alyssum/samba.nix index 708286a..1a32e38 100644 --- a/hosts/alyssum/samba.nix +++ b/hosts/alyssum/samba.nix @@ -33,7 +33,7 @@ "server string" = "smbnix"; "netbios name" = "smbnix"; "security" = "user"; - "hosts allow" = "100.67.2.1 127.0.0.1 localhost"; + "hosts allow" = "100.64.0.0/10 127.0.0.1 alyssum localhost"; "hosts deny" = "0.0.0.0/0"; "guest account" = "nobody"; "map to guest" = "bad user"; From 8157d0d5617bb0780f46c3e0aa1c97e8c9447488 Mon Sep 17 00:00:00 2001 From: Cilly Leang Date: Wed, 17 Jun 2026 19:49:10 +1000 Subject: [PATCH 45/57] alyssum/home.syncthing: init --- hosts/alyssum/default.nix | 1 + hosts/alyssum/home.syncthing.nix | 16 ++++++++++++++++ 2 files changed, 17 insertions(+) create mode 100644 hosts/alyssum/home.syncthing.nix diff --git a/hosts/alyssum/default.nix b/hosts/alyssum/default.nix index a2eb166..661e3d5 100644 --- a/hosts/alyssum/default.nix +++ b/hosts/alyssum/default.nix @@ -32,6 +32,7 @@ ./filesystem.nix ./kernel.nix ./networking.nix + ./home.syncthing.nix ./samba.nix ../../users/hana diff --git a/hosts/alyssum/home.syncthing.nix b/hosts/alyssum/home.syncthing.nix new file mode 100644 index 0000000..3335625 --- /dev/null +++ b/hosts/alyssum/home.syncthing.nix @@ -0,0 +1,16 @@ +{ config, ... }: { + me.binds."/home/kujira/.config/syncthing" = "kujira/syncthing/config"; + me.binds."/home/kujira/.local/state/syncthing" = "kujira/syncthing/state"; + + users.users.kujira = { + hashedPasswordFile = config.age.secrets.passwd.path; + isNormalUser = true; + linger = true; + }; + home-manager.users.kujira = { ... }: { + services.syncthing = { + enable = true; + guiAddress = ":8385"; + }; + }; +} From 9a821fda94f380a741a25e77760571a6aa77761f Mon Sep 17 00:00:00 2001 From: Cilly Leang Date: Wed, 17 Jun 2026 19:50:02 +1000 Subject: [PATCH 46/57] alyssum/home.syncthing: fixup hm config --- hosts/alyssum/home.syncthing.nix | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/hosts/alyssum/home.syncthing.nix b/hosts/alyssum/home.syncthing.nix index 3335625..5895716 100644 --- a/hosts/alyssum/home.syncthing.nix +++ b/hosts/alyssum/home.syncthing.nix @@ -8,6 +8,11 @@ linger = true; }; home-manager.users.kujira = { ... }: { + home = { + username = "kujira"; + homeDirectory = "/home/kujira"; + stateVersion = "26.05"; + }; services.syncthing = { enable = true; guiAddress = ":8385"; From 63d9d6b0044edd9a520aedbe1ab25dc9e9ec0b2e Mon Sep 17 00:00:00 2001 From: Cilly Leang Date: Wed, 17 Jun 2026 19:58:03 +1000 Subject: [PATCH 47/57] alyssum/home.syncthing: add host to gui address --- hosts/alyssum/home.syncthing.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hosts/alyssum/home.syncthing.nix b/hosts/alyssum/home.syncthing.nix index 5895716..929436b 100644 --- a/hosts/alyssum/home.syncthing.nix +++ b/hosts/alyssum/home.syncthing.nix @@ -15,7 +15,7 @@ }; services.syncthing = { enable = true; - guiAddress = ":8385"; + guiAddress = "[::]:8385"; }; }; } From bc3269a814934ccd8dfa95462735125cdc5d5762 Mon Sep 17 00:00:00 2001 From: Cilly Leang Date: Wed, 17 Jun 2026 20:29:22 +1000 Subject: [PATCH 48/57] alyssum/home.syncthing: create another instance --- hosts/alyssum/home.syncthing.nix | 40 ++++++++++++++++++-------------- 1 file changed, 23 insertions(+), 17 deletions(-) diff --git a/hosts/alyssum/home.syncthing.nix b/hosts/alyssum/home.syncthing.nix index 929436b..1e20f97 100644 --- a/hosts/alyssum/home.syncthing.nix +++ b/hosts/alyssum/home.syncthing.nix @@ -1,21 +1,27 @@ -{ config, ... }: { - me.binds."/home/kujira/.config/syncthing" = "kujira/syncthing/config"; - me.binds."/home/kujira/.local/state/syncthing" = "kujira/syncthing/state"; +{ config, lib, ... }: +let + configOn = user: port: { + me.binds."/home/${user}/.config/syncthing" = "${user}/syncthing/config"; + me.binds."/home/${user}/.local/state/syncthing" = "${user}/syncthing/state"; - users.users.kujira = { - hashedPasswordFile = config.age.secrets.passwd.path; - isNormalUser = true; - linger = true; - }; - home-manager.users.kujira = { ... }: { - home = { - username = "kujira"; - homeDirectory = "/home/kujira"; - stateVersion = "26.05"; + users.users.${user} = { + hashedPasswordFile = config.age.secrets.passwd.path; + isNormalUser = true; + linger = true; }; - services.syncthing = { - enable = true; - guiAddress = "[::]:8385"; + home-manager.users.${user} = { ... }: { + home = { + username = "${user}"; + homeDirectory = "/home/${user}"; + stateVersion = "26.05"; + }; + services.syncthing = { + enable = true; + guiAddress = "[::]:${toString port}"; + }; }; }; -} +in lib.mkMerge [ + (configOn "kujira" 8385) + (configOn "cilly" 8386) +] From 5c13051b4b291967d070e3d41dae2801bab17819 Mon Sep 17 00:00:00 2001 From: Cilly Leang Date: Wed, 17 Jun 2026 21:05:38 +1000 Subject: [PATCH 49/57] alyssum/samba: bind some directories --- hosts/alyssum/samba.nix | 159 +++++++++++++++++++--------------------- modules/binds.nix | 8 +- 2 files changed, 83 insertions(+), 84 deletions(-) diff --git a/hosts/alyssum/samba.nix b/hosts/alyssum/samba.nix index 1a32e38..f14365b 100644 --- a/hosts/alyssum/samba.nix +++ b/hosts/alyssum/samba.nix @@ -1,88 +1,83 @@ -{ config, pkgs, ... }: { - networking.firewall.allowPing = true; +{ config, lib, pkgs, ... }: +let + configOn = user: let + passwd_fname = "passwd_smb${user}"; + in { + age.secrets.${passwd_fname}.file = ../../secrets/${passwd_fname}.age; + me.binds."/flower/smb/${user}/syncthing" = "/flower/syncthing/${user}"; - age.secrets.passwd_smbcilly.file = ../../secrets/passwd_smbcilly.age; - age.secrets.passwd_smbkujira.file = ../../secrets/passwd_smbkujira.age; + users.users.${user} = { + hashedPasswordFile = config.age.secrets.passwd.path; + isNormalUser = true; + }; - users.users.cilly = { - hashedPasswordFile = config.age.secrets.passwd.path; - isNormalUser = true; - }; - users.users.kujira = { - hashedPasswordFile = config.age.secrets.passwd.path; - isNormalUser = true; - }; - system.activationScripts = { - init_smbpasswd.text = let - smbpasswd = "${config.services.samba.package}/bin/smbpasswd"; - in '' - printf "$(cat ${config.age.secrets.passwd_smbcilly.path})\n$(cat ${config.age.secrets.passwd_smbcilly.path})\n" | ${smbpasswd} -sa cilly - - printf "$(cat ${config.age.secrets.passwd_smbkujira.path})\n$(cat ${config.age.secrets.passwd_smbkujira.path})\n" | ${smbpasswd} -sa kujira - ''; - }; - - services.samba = { - enable = true; - package = pkgs.samba4Full; - openFirewall = true; - settings = { - global = { - "server smb encrypt" = "required"; - "workgroup" = "WORKGROUP"; - "server string" = "smbnix"; - "netbios name" = "smbnix"; - "security" = "user"; - "hosts allow" = "100.64.0.0/10 127.0.0.1 alyssum localhost"; - "hosts deny" = "0.0.0.0/0"; - "guest account" = "nobody"; - "map to guest" = "bad user"; - }; - "public" = { - "path" = "/flower/smb/public"; - "browseable" = "yes"; - "read only" = "no"; - "guest ok" = "yes"; - "create mask" = "0644"; - "directory mask" = "0755"; - "force user" = "hana"; - "force group" = "users"; - }; - "cilly" = { - "path" = "/flower/smb/cilly"; - "browseable" = "yes"; - "read only" = "no"; - "guest ok" = "no"; - "create mask" = "0644"; - "directory mask" = "0755"; - "force user" = "cilly"; - "force group" = "users"; - "valid users" = "cilly"; - }; - "kujira" = { - "path" = "/flower/smb/kujira"; - "browseable" = "yes"; - "read only" = "no"; - "guest ok" = "no"; - "create mask" = "0644"; - "directory mask" = "0755"; - "force user" = "kujira"; - "force group" = "users"; - "valid users" = "kujira"; - }; + system.activationScripts = { + init_smbpasswd.text = let + smbpasswd = "${config.services.samba.package}/bin/smbpasswd"; + in '' + printf "$(cat ${config.age.secrets.${passwd_fname}.path})\n$(cat ${config.age.secrets.${passwd_fname}.path})\n" | ${smbpasswd} -sa ${user} + ''; + }; + services.samba.settings."${user}" = { + "path" = "/flower/smb/${user}"; + "browseable" = "yes"; + "read only" = "no"; + "guest ok" = "no"; + "create mask" = "0644"; + "directory mask" = "0755"; + "force user" = user; + "force group" = "users"; + "valid users" = user; }; }; +in lib.mkMerge [ + (configOn "cilly") + (configOn "kujira") + { + me.binds."/flower/smb/kujira/opencloud" = "/flower/opencloud/data/storage/users/users/a8e29fc0-673c-4c67-be00-2442904acb43"; - services.samba-wsdd = { - enable = true; - openFirewall = true; - }; + networking.firewall.allowPing = true; - services.avahi = { - enable = true; - openFirewall = true; - nssmdns4 = true; - publish.enable = true; - publish.userServices = true; - }; -} + services.samba = { + enable = true; + package = pkgs.samba4Full; + openFirewall = true; + settings = { + global = { + "server smb encrypt" = "required"; + "workgroup" = "WORKGROUP"; + "server string" = "smbnix"; + "netbios name" = "smbnix"; + "security" = "user"; + "hosts allow" = "100.64.0.0/10 127.0.0.1 alyssum localhost"; + "hosts deny" = "0.0.0.0/0"; + "guest account" = "nobody"; + "map to guest" = "bad user"; + }; + "public" = { + "path" = "/flower/smb/public"; + "browseable" = "yes"; + "read only" = "no"; + "guest ok" = "yes"; + "create mask" = "0644"; + "directory mask" = "0755"; + "force user" = "hana"; + "force group" = "users"; + }; + }; + }; + + services.samba-wsdd = { + enable = true; + openFirewall = true; + }; + + services.avahi = { + enable = true; + openFirewall = true; + nssmdns4 = true; + publish.enable = true; + publish.userServices = true; + }; + } +] diff --git a/modules/binds.nix b/modules/binds.nix index 9c7d4ad..c9ffe18 100644 --- a/modules/binds.nix +++ b/modules/binds.nix @@ -1,8 +1,12 @@ { config, lib, ...}: { imports = [ ./options.nix ]; - fileSystems = lib.mapAttrs (dest: key: { + fileSystems = lib.mapAttrs (dest: key: let + target = if (lib.strings.hasPrefix "/" key) + then key + else "/persist/binds/${key}"; + in { depends = [ "/persist" ]; - device = "/persist/binds/${key}"; + device = target; fsType = "none"; options = [ "bind" ]; }) config.me.binds; From 907f2cabcadb6223c28fc6960b542f60bbadc860 Mon Sep 17 00:00:00 2001 From: Cilly Leang Date: Wed, 17 Jun 2026 21:14:47 +1000 Subject: [PATCH 50/57] alyssum/home.syncthing: set proper defaults --- hosts/alyssum/home.syncthing.nix | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/hosts/alyssum/home.syncthing.nix b/hosts/alyssum/home.syncthing.nix index 1e20f97..33545fe 100644 --- a/hosts/alyssum/home.syncthing.nix +++ b/hosts/alyssum/home.syncthing.nix @@ -4,6 +4,8 @@ let me.binds."/home/${user}/.config/syncthing" = "${user}/syncthing/config"; me.binds."/home/${user}/.local/state/syncthing" = "${user}/syncthing/state"; + systemd.tmpfiles.rules = [ "d /flower/syncthing/${user} 700 ${user} users" ]; + users.users.${user} = { hashedPasswordFile = config.age.secrets.passwd.path; isNormalUser = true; @@ -18,6 +20,12 @@ let services.syncthing = { enable = true; guiAddress = "[::]:${toString port}"; + options.listenAddresses = [ + "tcp://0.0.0.0:2${toString port}" + "quic://0.0.0.0:2${toString port}" + "dynamic+https://relays.syncthing.net/endpoint" + ]; + settings.defaults.folder.path = "/flower/syncthing/${user}"; }; }; }; From 6c80606b7ea743fca6ec146ab30cfb378d395d09 Mon Sep 17 00:00:00 2001 From: Cilly Leang Date: Wed, 17 Jun 2026 21:15:22 +1000 Subject: [PATCH 51/57] alyssum/home.syncthing: fixup conf --- hosts/alyssum/home.syncthing.nix | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/hosts/alyssum/home.syncthing.nix b/hosts/alyssum/home.syncthing.nix index 33545fe..4408fb7 100644 --- a/hosts/alyssum/home.syncthing.nix +++ b/hosts/alyssum/home.syncthing.nix @@ -20,12 +20,14 @@ let services.syncthing = { enable = true; guiAddress = "[::]:${toString port}"; - options.listenAddresses = [ - "tcp://0.0.0.0:2${toString port}" - "quic://0.0.0.0:2${toString port}" - "dynamic+https://relays.syncthing.net/endpoint" - ]; - settings.defaults.folder.path = "/flower/syncthing/${user}"; + settings = { + options.listenAddresses = [ + "tcp://0.0.0.0:2${toString port}" + "quic://0.0.0.0:2${toString port}" + "dynamic+https://relays.syncthing.net/endpoint" + ]; + defaults.folder.path = "/flower/syncthing/${user}"; + }; }; }; }; From 21dc584199e72285d0ec07083f604b439aa41b34 Mon Sep 17 00:00:00 2001 From: Cilly Leang Date: Wed, 17 Jun 2026 21:22:03 +1000 Subject: [PATCH 52/57] alyssum/home.syncthing: don't override devices and folders --- hosts/alyssum/home.syncthing.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/hosts/alyssum/home.syncthing.nix b/hosts/alyssum/home.syncthing.nix index 4408fb7..8d5a1cc 100644 --- a/hosts/alyssum/home.syncthing.nix +++ b/hosts/alyssum/home.syncthing.nix @@ -20,6 +20,8 @@ let services.syncthing = { enable = true; guiAddress = "[::]:${toString port}"; + overrideDevices = false; + overrideFolders = false; settings = { options.listenAddresses = [ "tcp://0.0.0.0:2${toString port}" From 4dfc89814003566d4fb55dbd84b29c4427b254b0 Mon Sep 17 00:00:00 2001 From: Cilly Leang Date: Fri, 19 Jun 2026 07:36:13 +1000 Subject: [PATCH 53/57] user/neovim: switch to nixd --- modules/system/nix.nix | 3 ++- modules/user/neovim.nix | 7 ++++--- res/config.lua | 28 +++++++++++++++++++++++++++- users/rin/packages.nix | 1 - 4 files changed, 33 insertions(+), 6 deletions(-) diff --git a/modules/system/nix.nix b/modules/system/nix.nix index 6a6fd04..eb14f73 100644 --- a/modules/system/nix.nix +++ b/modules/system/nix.nix @@ -1,5 +1,6 @@ -{ config, lib, pkgs, ... }: { +{ config, inputs, pkgs, ... }: { nix = { + nixPath = [ "nixpkgs=${inputs.nixpkgs}" ]; package = pkgs.nixVersions.latest; settings = rec { diff --git a/modules/user/neovim.nix b/modules/user/neovim.nix index d691c61..2b8d4c1 100644 --- a/modules/user/neovim.nix +++ b/modules/user/neovim.nix @@ -1,9 +1,9 @@ -{ config, lib, pkgs, ... }: +{ config, lib, pkgs, sysConfig, ... }: let luaconf = pkgs.writeText "config.lua" (lib.replaceStrings - ["{{OMNISHARP_PATH}}" "{{DART_PATH}}" "{{CATPPUCCIN_FLAVOUR}}"] - ["${pkgs.omnisharp-roslyn}/bin/OmniSharp" "${pkgs.dart}/bin/dart" config.catppuccin.nvim.flavor] + ["{{OMNISHARP_PATH}}" "{{DART_PATH}}" "{{CATPPUCCIN_FLAVOUR}}" "{{USERNAME}}" "{{HOSTNAME}}"] + ["${pkgs.omnisharp-roslyn}/bin/OmniSharp" "${pkgs.dart}/bin/dart" config.catppuccin.nvim.flavor config.home.username sysConfig.networking.hostName] (builtins.readFile ../../res/config.lua)); in { systemd.user.tmpfiles.rules = [ @@ -21,6 +21,7 @@ in { withRuby = false; extraPackages = with pkgs; [ + nixd rust-analyzer texlab astro-language-server diff --git a/res/config.lua b/res/config.lua index 3e91e28..c0b5dad 100644 --- a/res/config.lua +++ b/res/config.lua @@ -167,7 +167,7 @@ vim.diagnostic.config({ capabilities = require('cmp_nvim_lsp').default_capabilities(capabilities) -local servers = { 'astro', 'clangd', 'cssls', 'html', 'nil_ls', 'tailwindcss', 'texlab', 'ts_ls', 'yamlls' } +local servers = { 'astro', 'clangd', 'cssls', 'html', 'tailwindcss', 'texlab', 'ts_ls', 'yamlls' } for _, lsp in ipairs(servers) do vim.lsp.config(lsp, { capabilities = capabilities, @@ -292,6 +292,32 @@ vim.lsp.config("diagnosticls", { }) vim.lsp.enable("diagnosticls") +-- LSP/nixd +vim.lsp.config("nixd", { + cmd = { "nixd" }, + filetypes = { "nix" }, + root_markers = { "flake.nix", ".git" }, + settings = { + nixd = { + nixpkgs = { + expr = "import { }", + }, + formatting = { + command = { "nixfmt" }, + }, + options = { + nixos = { + expr = '(builtins.getFlake (toString ./.)).nixosConfigurations.{{HOSTNAME}}.options', + }, + home_manager = { + expr = '(builtins.getFlake (builtins.toString ./.)).nixosConfigurations."{{USERNAME}}@{{HOSTNAME}}".options.home-manager.users.type.getSubOptions []', + }, + }, + }, + }, +}) +vim.lsp.enable("nixd") + -- LSP/Signatures require("lsp_signature").setup { hint_enable = false, diff --git a/users/rin/packages.nix b/users/rin/packages.nix index afc711b..3fe0129 100644 --- a/users/rin/packages.nix +++ b/users/rin/packages.nix @@ -15,7 +15,6 @@ in { ffmpeg gnupg kitty - nil nodejs_latest pamixer pnpm From e1c02d7a91eb1b6c4c25c243fcc861de6611ce39 Mon Sep 17 00:00:00 2001 From: Cilly Leang Date: Fri, 19 Jun 2026 08:01:17 +1000 Subject: [PATCH 54/57] containers/emerald: move to alyssum --- containers/emerald/flake.nix | 12 +++--------- hosts/alyssum/default.nix | 2 ++ hosts/dandelion/default.nix | 3 +-- hosts/dandelion/nginx.nix | 8 ++++++++ secrets.nix | 2 +- secrets/navidrome_env.age | Bin 630 -> 630 bytes 6 files changed, 15 insertions(+), 12 deletions(-) create mode 100644 hosts/dandelion/nginx.nix diff --git a/containers/emerald/flake.nix b/containers/emerald/flake.nix index 9c9acdc..7e79b23 100644 --- a/containers/emerald/flake.nix +++ b/containers/emerald/flake.nix @@ -9,11 +9,11 @@ shareFqdn = "muse.lava.moe"; subnetId = "5"; - subnet = x: "fd0d:1::${subnetId}:${toString x}"; + subnet = x: "fd0d:2::${subnetId}:${toString x}"; host = subnet 1; client = subnet 2; - subnet4 = x: "10.30.${subnetId}.${toString x}"; + subnet4 = x: "10.32.${subnetId}.${toString x}"; host4 = subnet4 1; client4 = subnet4 2; @@ -39,13 +39,7 @@ useACMEHost = "lava.moe"; forceSSL = true; locations."/".proxyPass = "http://[${client}]:4533"; - listenAddresses = [ "10.0.0.1" "[fd0d::1]" "100.67.1.1" ]; - }; - services.nginx.virtualHosts."${shareFqdn}" = { - useACMEHost = "lava.moe"; - forceSSL = true; - locations."/".return = "404"; - locations."/share/".proxyPass = "http://[${client}]:4533"; + listenAddresses = [ "100.67.2.1" ]; }; systemd.tmpfiles.rules = [ "d /persist/containers/${name} 755 root users" ]; diff --git a/hosts/alyssum/default.nix b/hosts/alyssum/default.nix index 661e3d5..06c415f 100644 --- a/hosts/alyssum/default.nix +++ b/hosts/alyssum/default.nix @@ -6,6 +6,7 @@ age.secrets = { acme_dns.file = ../../secrets/acme_dns.age; passwd.file = ../../secrets/passwd.age; + navidrome_env.file = ../../secrets/navidrome_env.age; wpa_conf = { file = ../../secrets/wpa_conf.age; path = "/etc/wpa_supplicant/imperative.conf"; @@ -27,6 +28,7 @@ modules.services.nginx modules.services.syncthing + inputs.c-emerald.nixosModule inputs.c-garnet.nixosModule ./filesystem.nix diff --git a/hosts/dandelion/default.nix b/hosts/dandelion/default.nix index 33b6eec..f65dfd1 100644 --- a/hosts/dandelion/default.nix +++ b/hosts/dandelion/default.nix @@ -5,7 +5,6 @@ age.secrets = { acme_dns.file = ../../secrets/acme_dns.age; - navidrome_env.file = ../../secrets/navidrome_env.age; slskd_env.file = ../../secrets/slskd_env.age; wg_dandelion.file = ../../secrets/wg_dandelion.age; }; @@ -31,12 +30,12 @@ inputs.c-beryllium.nixosModule inputs.c-citrine.nixosModule inputs.c-diamond.nixosModule - inputs.c-emerald.nixosModule inputs.c-fluorite.nixosModule ./filesystem.nix ./kernel.nix ./networking.nix + ./nginx.nix ../../users/hana ]; diff --git a/hosts/dandelion/nginx.nix b/hosts/dandelion/nginx.nix new file mode 100644 index 0000000..c29de38 --- /dev/null +++ b/hosts/dandelion/nginx.nix @@ -0,0 +1,8 @@ +{ ... }: { + services.nginx.virtualHosts."muse.lava.moe" = { + useACMEHost = "lava.moe"; + forceSSL = true; + locations."/".return = "404"; + locations."/share/".proxyPass = "http://[fd0d:2::5:2]:4533"; + }; +} diff --git a/secrets.nix b/secrets.nix index bec70ef..b1f55e5 100644 --- a/secrets.nix +++ b/secrets.nix @@ -13,7 +13,7 @@ in { "secrets/wpa_conf.age".publicKeys = [ alyssum blossom rin ]; "secrets/acme_dns.age".publicKeys = [ alyssum dandelion hazel rin ]; - "secrets/navidrome_env.age".publicKeys = [ anemone dandelion rin ]; + "secrets/navidrome_env.age".publicKeys = [ alyssum dandelion rin ]; "secrets/slskd_env.age".publicKeys = [ anemone dandelion rin ]; "secrets/tailscale_auth.age".publicKeys = [ alyssum anemone blossom dandelion rin ]; "secrets/warden_admin.age".publicKeys = [ rin ]; diff --git a/secrets/navidrome_env.age b/secrets/navidrome_env.age index 6cb705c5d12523d7e403ecd2736ad062cc9756fe..7df364f2e273e47d57332c4379af715fc8a5212e 100644 GIT binary patch delta 584 zcmeyy@{MJJYJIl9Z*V}lLa~0SOIE(8PgRsjZmNfANJe2wPNjZ9K&nwvh`)KUw?}|y zah|!8zGG!ES3tUPYCwulX0BsVR8p0bmsfUvPO5&2S!h;hVwzuKWp+uHcVUTTdSRIf zm#&>cadC!jYKoDmsiCDpQjl9=YM_FCWl?sip<%gqwy#lonvqFjKvu9*l%cm%RD_Rz zPH>2SdRe%kae7vjv#~E%MTm2_M@pe-SdoEInPr7bzH3yWbF#aSXG&I7h-I;nrF%|F zewC4Ve!0QKkK*+n8Nr2a7A`?m`eorJM!{*uCTWH4zMkn>mQe-CroO3>ei?;@#Z~5M zPT5>0o>h*aL4~FUMUjSP2Kt4LRrw~C$+;O}=K96i8Rh}*z7`plg`Sq-?yg+Ay1EL9 z!TyHDId0x**{;q$X6{A#7A9%FnJ!TVfj&NdN&ZD?nSS-D>3-hk*~Q6ROqpWpMWV|d z&c4vI?M;r-tE{--Z%Xm=Lj$CDFLGWutD?BcP;&a@f0uoCZ!2GWs`sk3vUqjk;%iK` z+P^Q@zJ8i|WunSt<>I|nf4nn)t!g;n)&0q3m!$nYJ2|(F-vj?sG`WCg#Y;CB32Co4)>MRlf4+kK9tCZCbg>R9kL#Qr5a2&Gw+g7Uxv}q{-wD delta 584 zcmeyy@{MJJYJGl2WpIh3LZG*ASzdXWbADmIYe+zTa7bu&lwWarXh?RTdtpFIpi5Ga zyPJ7%nzx51S5k3cm}RK1et2$DNMw0dR$)$*x3h7Un^R$UQdDSAUSv^ZScPSXPf21r zm#&>cadC!jYKoDmsiCDpQjl9=YM_E;sAqUkqNAfxg>QjNvU_A|X@<7Gt5c+>c4bM4 zVP%kMn1@q%X--9UnMWv>VWC@Qk!gx=Rk&+va#@acqN7(zu7QD1QK@@id8uh~a%ymf zk%fDBQl-VjkK*;YsoG@~9(kUn6<$f6F8(e~-jkrv?<`6gazg)WY{CGJK+mA>^Rd6~u*mEnP0+oFBUOCsE* z3bwpzlgKR$u9$3^^ZVfWqPNN?4)f&tr`cQQ=D&Xa?73?U-wn%@sp~tnL(+v$>}C*F zxA`xn%JX>ouLo-iPxHCPx(V+O*cJKu@s3=59#dX}h>yFj?Z5ZfGA|o$zklp6 zX|@|&xOuuKjLFleVCnh`Z_lSp+>)?)gVX#Q4P6t?pZWIe&UJ&$5F8pXE@ck*9i%4 Date: Fri, 19 Jun 2026 08:57:22 +1000 Subject: [PATCH 55/57] containers/emerald: change mounts --- containers/emerald/configuration.nix | 2 +- containers/emerald/flake.nix | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/containers/emerald/configuration.nix b/containers/emerald/configuration.nix index f69a4c6..7f1f1fc 100644 --- a/containers/emerald/configuration.nix +++ b/containers/emerald/configuration.nix @@ -16,7 +16,7 @@ ShareURL = "https://${shareFqdn}"; EnableSharing = true; DataFolder = "/persist/navidrome"; - MusicFolder = "/binds/music"; + MusicFolder = "/binds/music/main"; }; }; } diff --git a/containers/emerald/flake.nix b/containers/emerald/flake.nix index 7e79b23..5ee69e4 100644 --- a/containers/emerald/flake.nix +++ b/containers/emerald/flake.nix @@ -62,7 +62,7 @@ isReadOnly = false; }; bindMounts."music" = { - hostPath = "/persist/media/music"; + hostPath = "/flower/media/music"; mountPoint = "/binds/music"; isReadOnly = true; }; From 004832fc066bc76a95cbb46d22e9833b5446dbff Mon Sep 17 00:00:00 2001 From: Cilly Leang Date: Fri, 19 Jun 2026 09:03:39 +1000 Subject: [PATCH 56/57] containers/emerald: bind music directory --- containers/emerald/configuration.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/containers/emerald/configuration.nix b/containers/emerald/configuration.nix index 7f1f1fc..421ddb0 100644 --- a/containers/emerald/configuration.nix +++ b/containers/emerald/configuration.nix @@ -19,4 +19,5 @@ MusicFolder = "/binds/music/main"; }; }; + systemd.services.navidrome.serviceConfig.BindReadOnlyPaths = ["/binds/music"]; } From c0004409d7aa14c8aacf166c7bf21b9cd5431135 Mon Sep 17 00:00:00 2001 From: Cilly Leang Date: Fri, 19 Jun 2026 09:12:52 +1000 Subject: [PATCH 57/57] alyssum/samba: bind music --- hosts/alyssum/samba.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/hosts/alyssum/samba.nix b/hosts/alyssum/samba.nix index f14365b..d876981 100644 --- a/hosts/alyssum/samba.nix +++ b/hosts/alyssum/samba.nix @@ -4,6 +4,7 @@ let passwd_fname = "passwd_smb${user}"; in { age.secrets.${passwd_fname}.file = ../../secrets/${passwd_fname}.age; + me.binds."/flower/smb/${user}/music" = "/flower/media/music/${user}"; me.binds."/flower/smb/${user}/syncthing" = "/flower/syncthing/${user}"; users.users.${user} = {